agenttesla | f5d4ebc19dcb1a8676ba1459a04606b5b94e3e1a02bf11393c18e0980e8da2f8

General

Target

831053927.exe
Size

371KB
MD5

5d766f42a531ffcd5dc28bb53aa241ba
SHA1

e249b9f9757a852c981943376cb1b1067170f6a6
SHA256

f5d4ebc19dcb1a8676ba1459a04606b5b94e3e1a02bf11393c18e0980e8da2f8
SHA512

c9d1470675401a9154129bda61da9e6c4e8cac912dee47d3bba9a4aaf9798cb51d3cc0a8689b7694890880e309d6adf21f74a0363993702861e9b34f655e3173
SSDEEP

6144:QBn1x+Iern1T/hLTUvO6XqaV7Co73QDYAD8zRDJhquOFLEyNbamvSkRN8h2zz2M+:gxDMHTKTXbZ573QEeY9JkJlEyNbaBm8t

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

hjctkgqb.exehjctkgqb.exe

pid process

2764 hjctkgqb.exe
4224 hjctkgqb.exe

pid	process
2764	hjctkgqb.exe
4224	hjctkgqb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hjctkgqb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crjqaqiplhx = "C:\\Users\\Admin\\AppData\\Roaming\\lrvilelmgxag\\ywnveswjguxq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\hjctkgqb.exe\" C:\\Users\\Admin\\AppDa"	hjctkgqb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

hjctkgqb.exe

description pid process target process

PID 2764 set thread context of 4224 2764 hjctkgqb.exe hjctkgqb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4536 4224 WerFault.exe hjctkgqb.exe
4652 4224 WerFault.exe hjctkgqb.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

hjctkgqb.exe

pid process

4224 hjctkgqb.exe
4224 hjctkgqb.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

hjctkgqb.exe

pid process

2764 hjctkgqb.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hjctkgqb.exe

description pid process

Token: SeDebugPrivilege 4224 hjctkgqb.exe

description	pid	process	target process
PID 2764 set thread context of 4224	2764	hjctkgqb.exe	hjctkgqb.exe

pid	pid_target	process	target process
4536	4224	WerFault.exe	hjctkgqb.exe
4652	4224	WerFault.exe	hjctkgqb.exe

pid	process
4224	hjctkgqb.exe
4224	hjctkgqb.exe

pid	process
2764	hjctkgqb.exe

description	pid	process
Token: SeDebugPrivilege	4224	hjctkgqb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

831053927.exehjctkgqb.exehjctkgqb.exe

description	pid	process	target process
PID 1164 wrote to memory of 2764	1164	831053927.exe	hjctkgqb.exe
PID 1164 wrote to memory of 2764	1164	831053927.exe	hjctkgqb.exe
PID 1164 wrote to memory of 2764	1164	831053927.exe	hjctkgqb.exe
PID 2764 wrote to memory of 4224	2764	hjctkgqb.exe	hjctkgqb.exe
PID 2764 wrote to memory of 4224	2764	hjctkgqb.exe	hjctkgqb.exe
PID 2764 wrote to memory of 4224	2764	hjctkgqb.exe	hjctkgqb.exe
PID 2764 wrote to memory of 4224	2764	hjctkgqb.exe	hjctkgqb.exe
PID 4224 wrote to memory of 4536	4224	hjctkgqb.exe	WerFault.exe
PID 4224 wrote to memory of 4536	4224	hjctkgqb.exe	WerFault.exe
PID 4224 wrote to memory of 4536	4224	hjctkgqb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\831053927.exe
"C:\Users\Admin\AppData\Local\Temp\831053927.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Admin\AppData\Local\Temp\hjctkgqb.exe
"C:\Users\Admin\AppData\Local\Temp\hjctkgqb.exe" C:\Users\Admin\AppData\Local\Temp\xrhedwyckj.oxb
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2764

C:\Users\Admin\AppData\Local\Temp\hjctkgqb.exe
"C:\Users\Admin\AppData\Local\Temp\hjctkgqb.exe" C:\Users\Admin\AppData\Local\Temp\xrhedwyckj.oxb
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 976
4⤵
- Program crash
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 976
4⤵
- Program crash
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4224 -ip 4224
1⤵
PID:2096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ccsvkpzcvk.p
Filesize
274KB

MD5
042160b92e75f00361f030ae9ce6ba5a

SHA1
ef6e7850bd70d8e4b1b1e9f3fa8cf0c529f2d4de

SHA256
3f96a57ac2629bff8e020ac29c33a01d77ad0363f7ec05049bb8a8d0c9330d41

SHA512
098f4b47d54f58e73083e8934693064db1b2b09224d49a84e6411a6c980f7f40ea13836f75b9726935635598bfab295a027080f756b90685019d3f0cd2a9075a

Download Submit
C:\Users\Admin\AppData\Local\Temp\hjctkgqb.exe
Filesize
320KB

MD5
48638249924ba4b3620a082e39dee170

SHA1
8cbac55e61abd52ebe3810ddccdd5cb49b276808

SHA256
fdb79e6ad186805cf8483cd05683020d9c2659ea9222ef6ba6857dcda8af944f

SHA512
9114200205f2f732c1e0f1e75f1fb36bca7b6255be4070782ce70c17b95d40c92240dda04c10303e86ae80baecf29be476464b1b6c12be85bcf1df6928ac27b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hjctkgqb.exe
Filesize
320KB

MD5
48638249924ba4b3620a082e39dee170

SHA1
8cbac55e61abd52ebe3810ddccdd5cb49b276808

SHA256
fdb79e6ad186805cf8483cd05683020d9c2659ea9222ef6ba6857dcda8af944f

SHA512
9114200205f2f732c1e0f1e75f1fb36bca7b6255be4070782ce70c17b95d40c92240dda04c10303e86ae80baecf29be476464b1b6c12be85bcf1df6928ac27b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hjctkgqb.exe
Filesize
320KB

MD5
48638249924ba4b3620a082e39dee170

SHA1
8cbac55e61abd52ebe3810ddccdd5cb49b276808

SHA256
fdb79e6ad186805cf8483cd05683020d9c2659ea9222ef6ba6857dcda8af944f

SHA512
9114200205f2f732c1e0f1e75f1fb36bca7b6255be4070782ce70c17b95d40c92240dda04c10303e86ae80baecf29be476464b1b6c12be85bcf1df6928ac27b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\xrhedwyckj.oxb
Filesize
7KB

MD5
d041100110d9e424d784b7304c86362e

SHA1
6989692ca832deb08f28de28f5d54ff5d84ee185

SHA256
985b212c76c8b5e36255fc2c588243f39f86461c636ea9092915d5dc588a82d1

SHA512
0e4b3134b81e7422dd930a6883761dfcc00065aa3f6465d988808c037f2d56dd9ec006873b73fbe5c345ba3a6c0299eb180d29411dc00f01737c5d8ce6d03bf5

Download Submit
memory/2764-132-0x0000000000000000-mapping.dmp

Download
memory/4224-137-0x0000000000000000-mapping.dmp

Download
memory/4224-139-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4224-140-0x0000000004B70000-0x0000000005114000-memory.dmp

Filesize
5.6MB

Download
memory/4224-141-0x0000000004A00000-0x0000000004A9C000-memory.dmp

Filesize
624KB

Download
memory/4536-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing