agenttesla | 070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba

General

Target

070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
Size

693KB
MD5

522e754681dd0ce6ee093418debaaaa3
SHA1

d92c7b8bcd8d3b3e468c27bd68c724538dd78cac
SHA256

070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba
SHA512

ef37b15e0a3887b68da233b5158e07b16e0a1f1e88d30ca5d6d5572d17f2d98f29d54c41bbc0c23b1584abd8ac98536a046f1acbb353f1c0c8e92255a0c6eb00
SSDEEP

12288:IK8BjODxaucUL49JU2WIJmZi9709qXQ+jOyLSESPPn+SdSzUqrmld2/Qaq/KgIuK:IlBy1Zp7CN6GyY/qb2/Qt/0WM

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.araskargopost.com
Port:
587
Username:
[email protected]
Password:
company1960

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1968-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1968-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1968-66-0x000000000043751E-mapping.dmp	family_agenttesla
behavioral1/memory/1968-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1968-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1968-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

description	pid	process	target process
PID 1764 set thread context of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

956 schtasks.exe

pid	process
956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

pid	process
1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
1968	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
1968	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

description	pid	process
Token: SeDebugPrivilege	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
Token: SeDebugPrivilege	1968	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

description	pid	process	target process
PID 1764 wrote to memory of 956	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	schtasks.exe
PID 1764 wrote to memory of 956	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	schtasks.exe
PID 1764 wrote to memory of 956	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	schtasks.exe
PID 1764 wrote to memory of 956	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	schtasks.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
PID 1764 wrote to memory of 1968	1764	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe	070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe

C:\Users\Admin\AppData\Local\Temp\070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
"C:\Users\Admin\AppData\Local\Temp\070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HnNUYxtn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp867F.tmp"
2⤵
- Creates scheduled task(s)
PID:956

C:\Users\Admin\AppData\Local\Temp\070ce8d430fc2f4619e6e5843831dabe5903d25f9561cf1fe1551359abafdbba.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp867F.tmp

Filesize
1KB

MD5
a6dccc550c3c5163f2c8ce50f6dfae35

SHA1
c4de93888dc47c22009f397b4d3977bb9533f9b1

SHA256
5cc3d4714ce61c7353053cdd0501e9197d2a3b9084d41fe2bb723d1e8870ddd1

SHA512
6a591c02c0734e41ef692cb637e856c13428632e0fb3bff1ef7542065a43cefe6a06db220f213ef7c71ed31e1a93add8cf6747875161ae444bdda1271c3ca757

Download Submit
memory/956-58-0x0000000000000000-mapping.dmp

Download
memory/1764-54-0x0000000000E60000-0x0000000000F16000-memory.dmp

Filesize
728KB

Download
memory/1764-55-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/1764-56-0x0000000000A00000-0x0000000000A0A000-memory.dmp

Filesize
40KB

Download
memory/1764-57-0x0000000005AD0000-0x0000000005B50000-memory.dmp

Filesize
512KB

Download
memory/1968-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-66-0x000000000043751E-mapping.dmp

Download
memory/1968-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads