agenttesla | 552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76

General

Target

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
Size

1.0MB
MD5

52a916b74fab3f2c9d2b2775bbd28642
SHA1

68e1ae1586f6aa2370ad2fac71efead1f12b3875
SHA256

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76
SHA512

b6a763b63bd45babaeaa49131077fec9dd7edb34ecc6ddfa3b5ab3f03d668ff9ad4a03a5c52164c6ef2ea32b0e4a698b48d193a728d6f948679397831724490a
SSDEEP

24576:I7bLoEslXMhl31Ju53x5K8yRAX4LJlR0//H:IDbsxMH1o53x5K8yRAX4LJn0n

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sky-qrp.com
Port:
587
Username:
[email protected]
Password:
h!xUls&%FS,V

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1440-142-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YYtJku = "C:\\Users\\Admin\\AppData\\Roaming\\YYtJku\\YYtJku.exe"	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

description	pid	process	target process
PID 4676 set thread context of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4956 schtasks.exe

pid	process
4956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

pid	process
4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
1440	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
1440	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

pid process

1440 552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

pid	process
1440	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

description	pid	process
Token: SeDebugPrivilege	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
Token: SeDebugPrivilege	1440	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

description	pid	process	target process
PID 4676 wrote to memory of 4956	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	schtasks.exe
PID 4676 wrote to memory of 4956	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	schtasks.exe
PID 4676 wrote to memory of 4956	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	schtasks.exe
PID 4676 wrote to memory of 1596	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1596	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1596	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
PID 4676 wrote to memory of 1440	4676	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe	552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe

C:\Users\Admin\AppData\Local\Temp\552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
"C:\Users\Admin\AppData\Local\Temp\552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qDJeDvkWgmGop" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A5B.tmp"
2⤵
- Creates scheduled task(s)
PID:4956

C:\Users\Admin\AppData\Local\Temp\552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
"C:\Users\Admin\AppData\Local\Temp\552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe"
2⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe
"C:\Users\Admin\AppData\Local\Temp\552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\552ef08623f28b4c41e1df65c2c09323965c408a5edbc49990b6eeeb0b51ff76.exe.log
Filesize
1KB

MD5
bb3d30439ec1e6435c3eac4df8c1d2e3

SHA1
c901d5946e53ae0a9e2417c8dfaf5786a0037422

SHA256
182adf89e57f80a92db9a5e13105cd59544f37855ca35f98116a0182ddd3b2e6

SHA512
d3547aadf665ce2552b3dfa350b80a5e813aa346870fb2b05a3b998096eebf563143bffe964e0f7243761b79420d1adf02f735779902901d1a41a1f35c557572

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9A5B.tmp
Filesize
1KB

MD5
674ad256c95396c540e090a3d2119d1d

SHA1
80c60713c4d06c976af18f5de257b0e8d2f8658a

SHA256
24cbc6c1c653e2b2cce7b02f911951dcf39fc364b12e4729dfdf21d26577093d

SHA512
e4a488ad3a1b972d4a9738544c4353ba1ae5f9df2eee6e7d97db1b28857df02e179f323643f0dd8a0e57235f71ca50913cb6b5ba22968e920c94dbd850c3713d

Download Submit
memory/1440-144-0x00000000065D0000-0x0000000006636000-memory.dmp

Filesize
408KB

Download
memory/1440-142-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1440-141-0x0000000000000000-mapping.dmp

Download
memory/1596-140-0x0000000000000000-mapping.dmp

Download
memory/4676-135-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Filesize
584KB

Download
memory/4676-137-0x0000000004DC0000-0x0000000004E16000-memory.dmp

Filesize
344KB

Download
memory/4676-136-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

Filesize
40KB

Download
memory/4676-132-0x0000000000030000-0x000000000013A000-memory.dmp

Filesize
1.0MB

Download
memory/4676-134-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/4676-133-0x0000000004AF0000-0x0000000004B8C000-memory.dmp

Filesize
624KB

Download
memory/4956-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads