agenttesla | b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435

General

Target

b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe
Size

788KB
MD5

ad3817edcf73c14ba5ade80473528672
SHA1

216dd18463fe1ca1a1fa017ca695699e43ca5776
SHA256

b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435
SHA512

2ea208e080829e0b93fb33f163440b508c2610d0ca8d20a2d2f39d72b81337b897b5da50fef64cee1a905aed74cf82b806a979abff0c0c68e5fded4cf0a55897
SSDEEP

12288:890DCE+DWjKEQo2QrhOm6nJ34QrqRZK6Tq3Ec8HpLwF4Ge9G0MkcWBSVWde/icqJ:89uoDcVr1SJ3TD6TYEiF4Gz8jS

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
server122.web-hosting.com
Port:
587
Username:
[email protected]
Password:
OJZg,yx3yFHQ

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1576-63-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1576-65-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1576-64-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1576-66-0x00000000004548EE-mapping.dmp	family_agenttesla
behavioral1/memory/1576-68-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral1/memory/1576-70-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe

description	pid	process	target process
PID 564 set thread context of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

284 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe

pid process

564 b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe

description pid process

Token: SeDebugPrivilege 564 b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe

pid	process
284	schtasks.exe

pid	process
564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe

description	pid	process
Token: SeDebugPrivilege	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe

description	pid	process	target process
PID 564 wrote to memory of 284	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	schtasks.exe
PID 564 wrote to memory of 284	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	schtasks.exe
PID 564 wrote to memory of 284	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	schtasks.exe
PID 564 wrote to memory of 284	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	schtasks.exe
PID 564 wrote to memory of 2036	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 2036	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 2036	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 2036	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 2036	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 2036	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 2036	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe
PID 564 wrote to memory of 1576	564	b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe
"C:\Users\Admin\AppData\Local\Temp\b3bcfa95470b746baa5c5460e70ddda1c1392c40aacce02214f2b2b7f9028435.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rtjcBPOueBlox" /XML "C:\Users\Admin\AppData\Local\Temp\tmp224.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp224.tmp

Filesize
1KB

MD5
1ddd1639919ead18a67a07052d2f0ae3

SHA1
b165a45ea77621c4b2cc6917234bdef47e0b56a9

SHA256
6549c2464c8ff39490682f2a4e5e49483fa9cfc00a1f7f38409a9edc8022f6d0

SHA512
3c27fc22d358caaaafbf5ede3259b034f64ec53d52078246f49c085bf2b60ae5a4875d8216bf57728cc7e8c96f49e505d7577f70e06d0c49798200931d471975

Download Submit
memory/284-58-0x0000000000000000-mapping.dmp

Download
memory/564-54-0x0000000000C20000-0x0000000000CEA000-memory.dmp

Filesize
808KB

Download
memory/564-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/564-56-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/564-57-0x0000000005180000-0x0000000005208000-memory.dmp

Filesize
544KB

Download
memory/1576-60-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1576-61-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1576-63-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1576-65-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1576-64-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1576-66-0x00000000004548EE-mapping.dmp

Download
memory/1576-68-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1576-70-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads