agenttesla | 370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771

General

Target

370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe
Size

626KB
MD5

dd16be66d8b6d4286f78f1fecde1571a
SHA1

a892492f269665c2813d0d0d2dddf7ae9e56c157
SHA256

370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771
SHA512

890ec6529153f59281d7047bcd6d788c4d8e9a1ceaf6016d6629b7d6c838c38fae55f5bf2ab3b98d80df4edc68c20f6e8dac0f45d16d2ed2229cab72eea3554f
SSDEEP

12288:i8lrM/Pe0KGFgEhoHE6WN5b5lroG+Fd41Q:lM/G0KGFx6Wjb5lriYa

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@Mexico1.,

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3108-141-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 532 set thread context of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3108	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe
3108	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3108	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 3632	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	86
PID 532 wrote to memory of 3632	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	86
PID 532 wrote to memory of 3632	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	86
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88
PID 532 wrote to memory of 3108	532	370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe	88

C:\Users\Admin\AppData\Local\Temp\370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe
"C:\Users\Admin\AppData\Local\Temp\370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ChAmmwjqyoVv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F8B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3632
- C:\Users\Admin\AppData\Local\Temp\370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe
  "C:\Users\Admin\AppData\Local\Temp\370d15a77a1f32863d977a71eed3cf94908b7d34728d098a82c0a4354d97f771.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7F8B.tmp

Filesize
1KB

MD5
5273c0200776841602b7232368b5c6a2

SHA1
1ac68866bcdbe927cc88205c9e90a42f375dcbb9

SHA256
9c718ad59b263c6a190107ae6bc3e722612471a65ecacb1a2bd8c89ff88d0796

SHA512
dff5cc0dd717a7f9d59767ebdd8368ac783c98cdf32d12d12bb4fe4094cf2290005b448509243eb600b0c31a9fcb2b0682443448391f7f500fde0b65df6fe436

Download Submit
memory/532-132-0x0000000000430000-0x00000000004D2000-memory.dmp

Filesize
648KB

Download
memory/532-133-0x0000000004E80000-0x0000000004F1C000-memory.dmp

Filesize
624KB

Download
memory/532-134-0x0000000005560000-0x0000000005B04000-memory.dmp

Filesize
5.6MB

Download
memory/532-135-0x0000000005050000-0x00000000050E2000-memory.dmp

Filesize
584KB

Download
memory/532-136-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Filesize
40KB

Download
memory/532-137-0x0000000004FB0000-0x0000000005006000-memory.dmp

Filesize
344KB

Download
memory/3108-141-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3108-142-0x0000000006710000-0x0000000006776000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads