agenttesla | 4825fd78e406e9bcb21ff45b65bc0b4bde7826243ead732bbbe03d032e4e7f05

General

Target

CALL KENDARI FOR LOADING.exe
Size

578KB
MD5

040ffb26c9ab0884a0aa2af46a92a19e
SHA1

c435f24b858eb46e9b812042f5c40c81a4228d7d
SHA256

789745b0db567cfc2ecf3c1230dac5b4063f091a48eba1137f8869edb2cfc7b6
SHA512

c3f8b6aea26cb75409e91145d87ea1d164f954771f8cba601253a7de0f98f056fefeb2f8c8342b89ab7be53bab7d7d844b7fe56faad0297096f53a5e2b84270e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
vicanto1994

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1408-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1408-64-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1408-65-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1408-66-0x0000000000446EBE-mapping.dmp	family_agenttesla
behavioral1/memory/1408-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1408-70-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

CALL KENDARI FOR LOADING.exe

description pid process target process

PID 1240 set thread context of 1408 1240 CALL KENDARI FOR LOADING.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1376 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

CALL KENDARI FOR LOADING.exeMSBuild.exe

pid process

1240 CALL KENDARI FOR LOADING.exe
1408 MSBuild.exe
1408 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CALL KENDARI FOR LOADING.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1240 CALL KENDARI FOR LOADING.exe
Token: SeDebugPrivilege 1408 MSBuild.exe

description	pid	process	target process
PID 1240 set thread context of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe

pid	process
1376	schtasks.exe

pid	process
1240	CALL KENDARI FOR LOADING.exe
1408	MSBuild.exe
1408	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1240	CALL KENDARI FOR LOADING.exe
Token: SeDebugPrivilege	1408	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

CALL KENDARI FOR LOADING.exe

description	pid	process	target process
PID 1240 wrote to memory of 1376	1240	CALL KENDARI FOR LOADING.exe	schtasks.exe
PID 1240 wrote to memory of 1376	1240	CALL KENDARI FOR LOADING.exe	schtasks.exe
PID 1240 wrote to memory of 1376	1240	CALL KENDARI FOR LOADING.exe	schtasks.exe
PID 1240 wrote to memory of 1376	1240	CALL KENDARI FOR LOADING.exe	schtasks.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe
PID 1240 wrote to memory of 1408	1240	CALL KENDARI FOR LOADING.exe	MSBuild.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\CALL KENDARI FOR LOADING.exe
"C:\Users\Admin\AppData\Local\Temp\CALL KENDARI FOR LOADING.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zRLgrOm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE32F.tmp"
2⤵
- Creates scheduled task(s)
PID:1376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1408

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE32F.tmp
Filesize
1KB

MD5
2cc4396bea471e92d4ca6f8e56ab5c8c

SHA1
43122e757fb1b9c22f630f45d7227892fa027673

SHA256
bbf011dd6bca5498bc69b06b016e03c93ebbbf2418c7077c223cc1a27f995030

SHA512
2c41be026f524e98d4707d6d6bac28bc67bc60015d9b3c67f24d808893095603e99b13e5b4b51f2f46b396fa9df0e77d928e5f9238abee0caebca66e7ebdfbd0

Download Submit
memory/1240-54-0x0000000000BD0000-0x0000000000C66000-memory.dmp

Filesize
600KB

Download
memory/1240-55-0x00000000002F0000-0x00000000002F8000-memory.dmp

Filesize
32KB

Download
memory/1240-56-0x0000000000A90000-0x0000000000AE4000-memory.dmp

Filesize
336KB

Download
memory/1240-57-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/1376-58-0x0000000000000000-mapping.dmp

Download
memory/1408-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1408-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1408-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1408-64-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1408-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1408-66-0x0000000000446EBE-mapping.dmp

Download
memory/1408-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1408-70-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads