agenttesla | 4a9c536d52f1f4f5c386866c763ecf23089fe4133da7894a04f3b14c624c87d7

General

Target

4a9c536d.exe
Size

742KB
MD5

9d4223f3d591d637560cab84f1423256
SHA1

be4ccc37f91857a0f8f3fc88934f5788ce48ff2c
SHA256

4a9c536d52f1f4f5c386866c763ecf23089fe4133da7894a04f3b14c624c87d7
SHA512

2dd55308a438c12a0b93b35d8877260055484a1fae30a61e3c550113c5c96c835214c5166972e4b16434dfe478f35213bef7deb365be4cf3ada62dfb4c56850a

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.italfood.ae
Port:
587
Username:
admin@italfood.ae
Password:
aDmin@IT$732

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/788-60-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/788-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/788-63-0x00000000004374BE-mapping.dmp	family_agenttesla
behavioral1/memory/788-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

4a9c536d.exe

description pid process target process

PID 1112 set thread context of 788 1112 4a9c536d.exe 4a9c536d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1728 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

4a9c536d.exe4a9c536d.exe

pid process

1112 4a9c536d.exe
788 4a9c536d.exe
788 4a9c536d.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4a9c536d.exe4a9c536d.exe

description pid process

Token: SeDebugPrivilege 1112 4a9c536d.exe
Token: SeDebugPrivilege 788 4a9c536d.exe

description	pid	process	target process
PID 1112 set thread context of 788	1112	4a9c536d.exe	4a9c536d.exe

pid	process
1728	schtasks.exe

pid	process
1112	4a9c536d.exe
788	4a9c536d.exe
788	4a9c536d.exe

description	pid	process
Token: SeDebugPrivilege	1112	4a9c536d.exe
Token: SeDebugPrivilege	788	4a9c536d.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

4a9c536d.exe4a9c536d.exe

description	pid	process	target process
PID 1112 wrote to memory of 1728	1112	4a9c536d.exe	schtasks.exe
PID 1112 wrote to memory of 1728	1112	4a9c536d.exe	schtasks.exe
PID 1112 wrote to memory of 1728	1112	4a9c536d.exe	schtasks.exe
PID 1112 wrote to memory of 1728	1112	4a9c536d.exe	schtasks.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 1112 wrote to memory of 788	1112	4a9c536d.exe	4a9c536d.exe
PID 788 wrote to memory of 664	788	4a9c536d.exe	dw20.exe
PID 788 wrote to memory of 664	788	4a9c536d.exe	dw20.exe
PID 788 wrote to memory of 664	788	4a9c536d.exe	dw20.exe
PID 788 wrote to memory of 664	788	4a9c536d.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\4a9c536d.exe
"C:\Users\Admin\AppData\Local\Temp\4a9c536d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\psDqVKTIAXYyCy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp20.tmp"
2⤵
- Creates scheduled task(s)
PID:1728

C:\Users\Admin\AppData\Local\Temp\4a9c536d.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 520
3⤵
PID:664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp20.tmp
MD5
c8ae97b091aa614fbe1d99dcc2701b37

SHA1
5133af38eb1b7b7dbd92e559ef80fb542ed5f0f5

SHA256
34a4487cb376bd33aa61fb29fe4377613fa53dc5e608c27dc5376924a31d301e

SHA512
b37dbd45857284bb0e50652be4a4c93d628bcf4ced5b900107478014bcf1db457ed31f11bac0e101f1d4be45611a1dfddce95598e496975d143d4872600a75b7

Download Submit
memory/664-68-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/664-66-0x0000000000000000-mapping.dmp

Download
memory/788-63-0x00000000004374BE-mapping.dmp

Download
memory/788-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/788-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/788-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/788-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/788-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/788-65-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1112-53-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1112-55-0x0000000001F71000-0x0000000001F72000-memory.dmp

Filesize
4KB

Download
memory/1112-54-0x0000000001F70000-0x0000000001F71000-memory.dmp

Filesize
4KB

Download
memory/1728-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads