agenttesla | f17529fa89fe55728e6e6204f78cdc50679f910177d01c4395924391f8b914f4

General

Target

ORDER108.exe
Size

557KB
MD5

eca7c987418ed08b28e1f61ed404cac0
SHA1

47fb70bf5623f677e65700c93d275f6b54a88012
SHA256

f1677cc4e344449edc0f1aee639dd24fedd8a91bf17b4be11e3b71543bac301e
SHA512

e5f2b0726541ba4fa6db249ccd1d795baefddb38043f8d7ece947d24aaf575c3541b8d8340e5ae78103524680c4043af4e36df727909cce1c06274ea140f39d0

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
webmail.saritatravels.com
Port:
587
Username:
[email protected]
Password:
sameerb%$321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/964-61-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/964-62-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/964-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/964-64-0x0000000000446EFE-mapping.dmp	family_agenttesla
behavioral1/memory/964-66-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/964-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

ORDER108.exe

description pid process target process

PID 796 set thread context of 964 796 ORDER108.exe ORDER108.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

840 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ORDER108.exe

pid process

964 ORDER108.exe
964 ORDER108.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ORDER108.exe

description pid process

Token: SeDebugPrivilege 964 ORDER108.exe

description	pid	process	target process
PID 796 set thread context of 964	796	ORDER108.exe	ORDER108.exe

pid	process
840	schtasks.exe

pid	process
964	ORDER108.exe
964	ORDER108.exe

description	pid	process
Token: SeDebugPrivilege	964	ORDER108.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

ORDER108.exe

description	pid	process	target process
PID 796 wrote to memory of 840	796	ORDER108.exe	schtasks.exe
PID 796 wrote to memory of 840	796	ORDER108.exe	schtasks.exe
PID 796 wrote to memory of 840	796	ORDER108.exe	schtasks.exe
PID 796 wrote to memory of 840	796	ORDER108.exe	schtasks.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe
PID 796 wrote to memory of 964	796	ORDER108.exe	ORDER108.exe

C:\Users\Admin\AppData\Local\Temp\ORDER108.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER108.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KcfUVHRZiXLQnL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD5B7.tmp"
2⤵
- Creates scheduled task(s)
PID:840

C:\Users\Admin\AppData\Local\Temp\ORDER108.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD5B7.tmp
Filesize
1KB

MD5
c1c5db51a5905464af1cc8109dd2143d

SHA1
13db97a1c517cd90ddace1a6ba74cd52e26419c4

SHA256
79e066d474deb762fbf2344a5a61753418afead4adf1e76b240f0959619e0d07

SHA512
a205b29aebabf3765b5c951aa56f0d5cef7a6141c01572542a1327668e161dabfe8fc43eb2cff25825b7bb0b27aa7d8a4e7bfc9268e84a3218c4e427599765a2

Download Submit
memory/796-54-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download
memory/796-55-0x0000000074FE0000-0x000000007558B000-memory.dmp

Filesize
5.7MB

Download
memory/840-56-0x0000000000000000-mapping.dmp

Download
memory/964-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/964-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/964-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/964-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/964-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/964-64-0x0000000000446EFE-mapping.dmp

Download
memory/964-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/964-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/964-70-0x0000000074F70000-0x000000007551B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads