agenttesla | ff97953e40782435e5aab8bf6469f7817f45f1c1f7f10961b406002e781fe6e7

General

Target

SEB_BANK.EXE
Size

27KB
MD5

ed3366cb849f6d62bb381e66d96b42ff
SHA1

41dd0051e764c1d2bf820b753c41f249fd25ba8a
SHA256

13f1dfeffed355ec22cb812a98ae895fa0ac4f5e83f9ff5598649b3933f0d53e
SHA512

6423e833a759a989a6d23ee03d244771d05c2a292ecb420e5b641ec047fa33fec2ba7e96d909474689480804298baa3d54f554f4e11954b742cd6c10dda7feec

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.ingeniumhea.com
Port:
587
Username:
mantenimiento@ingeniumhea.com
Password:
IngeniumM18

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1652-75-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1652-76-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1652-77-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1652-78-0x0000000000436D0E-mapping.dmp	family_agenttesla
behavioral1/memory/1652-79-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

SEB_BANK.EXE

description pid process target process

PID 1684 set thread context of 1652 1684 SEB_BANK.EXE SEB_BANK.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

1548 PING.EXE
1696 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exeSEB_BANK.EXESEB_BANK.EXE

pid process

1496 powershell.exe
1348 powershell.exe
1684 SEB_BANK.EXE
1684 SEB_BANK.EXE
1652 SEB_BANK.EXE
1652 SEB_BANK.EXE

description	pid	process	target process
PID 1684 set thread context of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE

pid	process
1548	PING.EXE
1696	PING.EXE

pid	process
1496	powershell.exe
1348	powershell.exe
1684	SEB_BANK.EXE
1684	SEB_BANK.EXE
1652	SEB_BANK.EXE
1652	SEB_BANK.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SEB_BANK.EXEpowershell.exepowershell.exeSEB_BANK.EXE

description	pid	process
Token: SeDebugPrivilege	1684	SEB_BANK.EXE
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	1652	SEB_BANK.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

SEB_BANK.EXEpowershell.exepowershell.exe

description	pid	process	target process
PID 1684 wrote to memory of 1496	1684	SEB_BANK.EXE	powershell.exe
PID 1684 wrote to memory of 1496	1684	SEB_BANK.EXE	powershell.exe
PID 1684 wrote to memory of 1496	1684	SEB_BANK.EXE	powershell.exe
PID 1684 wrote to memory of 1496	1684	SEB_BANK.EXE	powershell.exe
PID 1496 wrote to memory of 1548	1496	powershell.exe	PING.EXE
PID 1496 wrote to memory of 1548	1496	powershell.exe	PING.EXE
PID 1496 wrote to memory of 1548	1496	powershell.exe	PING.EXE
PID 1496 wrote to memory of 1548	1496	powershell.exe	PING.EXE
PID 1684 wrote to memory of 1348	1684	SEB_BANK.EXE	powershell.exe
PID 1684 wrote to memory of 1348	1684	SEB_BANK.EXE	powershell.exe
PID 1684 wrote to memory of 1348	1684	SEB_BANK.EXE	powershell.exe
PID 1684 wrote to memory of 1348	1684	SEB_BANK.EXE	powershell.exe
PID 1348 wrote to memory of 1696	1348	powershell.exe	PING.EXE
PID 1348 wrote to memory of 1696	1348	powershell.exe	PING.EXE
PID 1348 wrote to memory of 1696	1348	powershell.exe	PING.EXE
PID 1348 wrote to memory of 1696	1348	powershell.exe	PING.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE
PID 1684 wrote to memory of 1652	1684	SEB_BANK.EXE	SEB_BANK.EXE

C:\Users\Admin\AppData\Local\Temp\SEB_BANK.EXE
"C:\Users\Admin\AppData\Local\Temp\SEB_BANK.EXE"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" bing.com
3⤵
- Runs ping.exe
PID:1548

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\system32\PING.EXE" bing.com
3⤵
- Runs ping.exe
PID:1696

C:\Users\Admin\AppData\Local\Temp\SEB_BANK.EXE
C:\Users\Admin\AppData\Local\Temp\SEB_BANK.EXE
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
5802a3795d07ff702c9b977218604d33

SHA1
fd76dbab1eaf22d2fb3251b007c901520e95ec95

SHA256
fe0422e3a996031b3832dd9339f64064389d0dedd97849bb9167f9e91c8aeda8

SHA512
e7baffd5bd192fd83d98a61b7e4989eefc95608f25e3b0732295110ab5133dd6fd8502ea45fdb2cca6f0647f4e63c33346743f39f21356e6182d82a6b8e2eaf6

Download Submit
memory/1348-69-0x0000000002370000-0x0000000002FBA000-memory.dmp

Filesize
12.3MB

Download
memory/1348-68-0x0000000002370000-0x0000000002FBA000-memory.dmp

Filesize
12.3MB

Download
memory/1348-67-0x0000000002370000-0x0000000002FBA000-memory.dmp

Filesize
12.3MB

Download
memory/1348-63-0x0000000000000000-mapping.dmp

Download
memory/1496-59-0x0000000000000000-mapping.dmp

Download
memory/1496-61-0x00000000024B0000-0x00000000030FA000-memory.dmp

Filesize
12.3MB

Download
memory/1548-62-0x0000000000000000-mapping.dmp

Download
memory/1652-74-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1652-81-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/1652-79-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1652-78-0x0000000000436D0E-mapping.dmp

Download
memory/1652-77-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1652-76-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1652-75-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1652-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-57-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1684-72-0x00000000042D0000-0x00000000042F6000-memory.dmp

Filesize
152KB

Download
memory/1684-71-0x0000000004915000-0x0000000004926000-memory.dmp

Filesize
68KB

Download
memory/1684-70-0x00000000083F0000-0x0000000008466000-memory.dmp

Filesize
472KB

Download
memory/1684-58-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/1684-55-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1696-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads