agenttesla | 8dd97dc341e72b4830a7375c3e51de56ac35b91a31498d2dbeba929846d6129e

General

Target

YyeznSFcE5IUYLS.exe
Size

936KB
MD5

49ad4e42ac4829d60cb703811a951363
SHA1

d0deb06327fc6545177fabaaff9a14312a9e2d2c
SHA256

a5eb38594eb57ed5010a258b0f35aa3647243e8eb5ba4474eee9808abcaeb149
SHA512

7a144c931c1b313f4783c1b11e7df41ac1a893bfb80dce5942eb75e8b0e9533c3de7cf720444070df4d95dc730227e71b0542e769fc6a41e22008d901d141700

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.privateemail.com
Port:
587
Username:
[email protected]
Password:
MARYolanmauluogwo@ever

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1148-62-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla
behavioral3/memory/1148-63-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla
behavioral3/memory/1148-64-0x0000000000400000-0x0000000000458000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

YyeznSFcE5IUYLS.exe

description pid process target process

PID 1340 set thread context of 1148 1340 YyeznSFcE5IUYLS.exe YyeznSFcE5IUYLS.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1212 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

YyeznSFcE5IUYLS.exe

pid process

1148 YyeznSFcE5IUYLS.exe
1148 YyeznSFcE5IUYLS.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

dw20.exe

pid process

1180 dw20.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

YyeznSFcE5IUYLS.exe

description pid process

Token: SeDebugPrivilege 1148 YyeznSFcE5IUYLS.exe

description	pid	process	target process
PID 1340 set thread context of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe

pid	process
1212	schtasks.exe

pid	process
1148	YyeznSFcE5IUYLS.exe
1148	YyeznSFcE5IUYLS.exe

pid	process
1180	dw20.exe

description	pid	process
Token: SeDebugPrivilege	1148	YyeznSFcE5IUYLS.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

YyeznSFcE5IUYLS.exeYyeznSFcE5IUYLS.exe

description	pid	process	target process
PID 1340 wrote to memory of 1212	1340	YyeznSFcE5IUYLS.exe	schtasks.exe
PID 1340 wrote to memory of 1212	1340	YyeznSFcE5IUYLS.exe	schtasks.exe
PID 1340 wrote to memory of 1212	1340	YyeznSFcE5IUYLS.exe	schtasks.exe
PID 1340 wrote to memory of 1212	1340	YyeznSFcE5IUYLS.exe	schtasks.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1340 wrote to memory of 1148	1340	YyeznSFcE5IUYLS.exe	YyeznSFcE5IUYLS.exe
PID 1148 wrote to memory of 1180	1148	YyeznSFcE5IUYLS.exe	dw20.exe
PID 1148 wrote to memory of 1180	1148	YyeznSFcE5IUYLS.exe	dw20.exe
PID 1148 wrote to memory of 1180	1148	YyeznSFcE5IUYLS.exe	dw20.exe
PID 1148 wrote to memory of 1180	1148	YyeznSFcE5IUYLS.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\YyeznSFcE5IUYLS.exe
"C:\Users\Admin\AppData\Local\Temp\YyeznSFcE5IUYLS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XvrLwUcwoTObw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8556.tmp"
2⤵
- Creates scheduled task(s)
PID:1212

C:\Users\Admin\AppData\Local\Temp\YyeznSFcE5IUYLS.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 516
3⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8556.tmp

MD5
9c0f2ed0a095047a5b4633d9fc2a5cb3

SHA1
dc71a37efd0a07f94e188b4628a08fa043013897

SHA256
cb978b6f4b93ad6f8cfb7203d995be6273e5dafccb46a1937c2d40455ca3a3a5

SHA512
5156f77b4cd996cabebcdfe745ab2e0f766e1b7a0fd75d14ee3fd77baf5286b1c35b72207237f15f6c7385bc1b54c99f748e52707693f48d20c6c900ec445aa2

Download Submit
memory/1148-63-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1148-67-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1148-68-0x0000000074732000-0x0000000074734000-memory.dmp

Filesize
8KB

Download
memory/1148-66-0x0000000074731000-0x0000000074732000-memory.dmp

Filesize
4KB

Download
memory/1148-64-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1148-60-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1148-61-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1148-62-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1180-70-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/1340-54-0x0000000074731000-0x0000000074732000-memory.dmp

Filesize
4KB

Download
memory/1340-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1340-56-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/1340-58-0x0000000000731000-0x0000000000732000-memory.dmp

Filesize
4KB

Download
memory/1340-57-0x0000000074732000-0x0000000074734000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads