agenttesla | 326866f45d9012b4997faa5c2d6d7b21421db4d7d60ee050b46dee9515a3ac40

General

Target

Purchase Inquiry Datasheet Of Listed Items.exe
Size

786KB
MD5

de95d2e03aaff80b18b08e155642b266
SHA1

be1450801821cdc916570479e618a67090b82102
SHA256

a52c72aa195562b2f469e6dbc1e2e7534aec440d4674cedb788f3800286ecbbf
SHA512

2fe944c2731b5e3103337dc571de08d78fd7c1c47d0dfc68cc996b3057d476ddbe72bff97bad6bd3c58deda53ba1257b319208f2de7e49677b477134d0794371

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
server122.web-hosting.com
Port:
587
Username:
burna@cdperenco.com
Password:
OJZg,yx3yFHQ

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1760-65-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1760-64-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1760-66-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1760-67-0x00000000004548EE-mapping.dmp	family_agenttesla
behavioral1/memory/1760-69-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1760-71-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase Inquiry Datasheet Of Listed Items.exe

description	pid	process	target process
PID 316 set thread context of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1276 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Purchase Inquiry Datasheet Of Listed Items.exe

pid process

1760 Purchase Inquiry Datasheet Of Listed Items.exe
1760 Purchase Inquiry Datasheet Of Listed Items.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Purchase Inquiry Datasheet Of Listed Items.exe

description pid process

Token: SeDebugPrivilege 1760 Purchase Inquiry Datasheet Of Listed Items.exe

pid	process
1276	schtasks.exe

pid	process
1760	Purchase Inquiry Datasheet Of Listed Items.exe
1760	Purchase Inquiry Datasheet Of Listed Items.exe

description	pid	process
Token: SeDebugPrivilege	1760	Purchase Inquiry Datasheet Of Listed Items.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Purchase Inquiry Datasheet Of Listed Items.exe

description	pid	process	target process
PID 316 wrote to memory of 1276	316	Purchase Inquiry Datasheet Of Listed Items.exe	schtasks.exe
PID 316 wrote to memory of 1276	316	Purchase Inquiry Datasheet Of Listed Items.exe	schtasks.exe
PID 316 wrote to memory of 1276	316	Purchase Inquiry Datasheet Of Listed Items.exe	schtasks.exe
PID 316 wrote to memory of 1276	316	Purchase Inquiry Datasheet Of Listed Items.exe	schtasks.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe
PID 316 wrote to memory of 1760	316	Purchase Inquiry Datasheet Of Listed Items.exe	Purchase Inquiry Datasheet Of Listed Items.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry Datasheet Of Listed Items.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry Datasheet Of Listed Items.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uyIbAslkFaYVOs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp231B.tmp"
2⤵
- Creates scheduled task(s)
PID:1276

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry Datasheet Of Listed Items.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry Datasheet Of Listed Items.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp231B.tmp
Filesize
1KB

MD5
75b0e3e01c923337ec73d8ad89310fc4

SHA1
8d656bbd76bd95f998c61a20480aec651f720e6e

SHA256
1f1133b469c0717e7867a80745a9c7d83d1a23a7b214fa05bd5e8e71e8c1d8c8

SHA512
05c0ccc024c659043c11228c44303c0689ff0d0a20d7bc793d388611dbdec57bdfdb10fd5d56156528820d38630bf7e85259020ac242f6faf00a096b98d84d07

Download Submit
memory/316-57-0x0000000005340000-0x00000000053B4000-memory.dmp

Filesize
464KB

Download
memory/316-56-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/316-54-0x0000000000B00000-0x0000000000BCA000-memory.dmp

Filesize
808KB

Download
memory/316-58-0x0000000004970000-0x00000000049CA000-memory.dmp

Filesize
360KB

Download
memory/316-55-0x0000000076431000-0x0000000076433000-memory.dmp

Filesize
8KB

Download
memory/1276-59-0x0000000000000000-mapping.dmp

Download
memory/1760-62-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1760-61-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1760-65-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1760-64-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1760-66-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1760-67-0x00000000004548EE-mapping.dmp

Download
memory/1760-69-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1760-71-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads