agenttesla | b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07

General

Target

b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe
Size

891KB
MD5

279794744b9f022ebe655c791a8e1578
SHA1

e45225509f5cafa7add2b6702840fc356a422ba0
SHA256

b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07
SHA512

ad5091feee766f15a49de75dad3c74dced10b8c7e3d574e16a04f815939feb20e058fe4e8ee51733f172d75d83939d0499999d3a69ddb430dc4abbf26b702e4b

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
t$KMOPJ9

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/1284-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1284-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1284-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1284-65-0x00000000004375FE-mapping.dmp	family_agenttesla
behavioral1/memory/1284-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1284-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1924 set thread context of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe
1284	vbc.exe
1284	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe
Token: SeDebugPrivilege	1284	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 692	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	29
PID 1924 wrote to memory of 692	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	29
PID 1924 wrote to memory of 692	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	29
PID 1924 wrote to memory of 692	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	29
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31
PID 1924 wrote to memory of 1284	1924	b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe	31

C:\Users\Admin\AppData\Local\Temp\b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe
"C:\Users\Admin\AppData\Local\Temp\b709fac7630fa728c21d189818663b2c1459f8881f8674c06dbe300d437b9b07.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NKkBqEEi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC2E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBC2E.tmp

Filesize
1KB

MD5
fbfcd1cd87d907a549d899bab025bdf1

SHA1
a4899e97f643330324d844cf1f6cf640f5892513

SHA256
05b2830cb3f7e598a486509aacc21b157b18ad635ed83f31f765ab57a9979f41

SHA512
b8388b5214744a3acfc7e601ab9b93e9d6695b448c669f976e1d36b2b7aee5226c6e4b25e52d5fde8134b69bcfb91ab0550f8e2e588d8e64978de07a44d015ce

Download Submit
memory/1284-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1284-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1924-56-0x0000000005700000-0x00000000057B6000-memory.dmp

Filesize
728KB

Download
memory/1924-55-0x0000000000460000-0x000000000047E000-memory.dmp

Filesize
120KB

Download
memory/1924-54-0x0000000000A60000-0x0000000000B46000-memory.dmp

Filesize
920KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads