agenttesla | 5cb3497f614368c3ac65a5e54a7fb3686b4252286f6f32bd608323f01b8f33b0

General

Target

INQ#10932.exe
Size

910KB
MD5

ab173fc941b3ff29b61a7c367a20f0c9
SHA1

7c2d64b587f9f61e4db8c51684194ce090c0325a
SHA256

dc33d410898885b637ad8dd510d290ff2c00ae00069f28a60a282364faf0384e
SHA512

2101db46bdd426ccd977db05324910c6d1b33eaab02a3fd88d3b2e74b404b1243abf1f7d4e34536d02a2e308428eaa15d6c4d8ada44a4c317d00ec68c57533f1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@Mexico1.,

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1964-64-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1964-65-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1964-66-0x000000000044748E-mapping.dmp	family_agenttesla
behavioral1/memory/1964-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1964-70-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

INQ#10932.exe

description pid process target process

PID 1676 set thread context of 1964 1676 INQ#10932.exe INQ#10932.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

960 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

INQ#10932.exeINQ#10932.exe

pid process

1676 INQ#10932.exe
1964 INQ#10932.exe
1964 INQ#10932.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INQ#10932.exeINQ#10932.exe

description pid process

Token: SeDebugPrivilege 1676 INQ#10932.exe
Token: SeDebugPrivilege 1964 INQ#10932.exe

description	pid	process	target process
PID 1676 set thread context of 1964	1676	INQ#10932.exe	INQ#10932.exe

pid	process
960	schtasks.exe

pid	process
1676	INQ#10932.exe
1964	INQ#10932.exe
1964	INQ#10932.exe

description	pid	process
Token: SeDebugPrivilege	1676	INQ#10932.exe
Token: SeDebugPrivilege	1964	INQ#10932.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

INQ#10932.exe

description	pid	process	target process
PID 1676 wrote to memory of 960	1676	INQ#10932.exe	schtasks.exe
PID 1676 wrote to memory of 960	1676	INQ#10932.exe	schtasks.exe
PID 1676 wrote to memory of 960	1676	INQ#10932.exe	schtasks.exe
PID 1676 wrote to memory of 960	1676	INQ#10932.exe	schtasks.exe
PID 1676 wrote to memory of 852	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 852	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 852	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 852	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe
PID 1676 wrote to memory of 1964	1676	INQ#10932.exe	INQ#10932.exe

C:\Users\Admin\AppData\Local\Temp\INQ#10932.exe
"C:\Users\Admin\AppData\Local\Temp\INQ#10932.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emnGSvCqPQSKI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp19A9.tmp"
2⤵
- Creates scheduled task(s)
PID:960

C:\Users\Admin\AppData\Local\Temp\INQ#10932.exe
"{path}"
2⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\INQ#10932.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp19A9.tmp

Filesize
1KB

MD5
ffcab640583b2e88f3bd1ad37c71d59d

SHA1
2f3fce64a118bea843c08cf9c8b893ad4265bbad

SHA256
62a60565eae162cc6cb5c4c4832ee3d396db23aabb31bae73b9e79c94761a921

SHA512
2d32e5ff9c3616ba5ccb61c487e9f030e8e0223f8986ce678487f7f2c77e367314c5979c3090af655582c75dfb005f4f3eff6327e3421de82368aedaa2c185fa

Download Submit
memory/960-58-0x0000000000000000-mapping.dmp

Download
memory/1676-54-0x00000000009A0000-0x0000000000A8A000-memory.dmp

Filesize
936KB

Download
memory/1676-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1676-56-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/1676-57-0x0000000002240000-0x0000000002294000-memory.dmp

Filesize
336KB

Download
memory/1964-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1964-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1964-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1964-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1964-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1964-66-0x000000000044748E-mapping.dmp

Download
memory/1964-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1964-70-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads