agenttesla | 4a5d563e7519d9b2e7321abc2aa2355ecb22ed8d60e34061a0f935757a6a0f82

General

Target

Consulta de compra.exe
Size

300.1MB
MD5

4a6c4f83ba59f169f41a77eed6d08fd3
SHA1

725e35e280c140840263b0a47d449b9e03e36942
SHA256

4a5d563e7519d9b2e7321abc2aa2355ecb22ed8d60e34061a0f935757a6a0f82
SHA512

2fe598182197d0f1ca7750ec9ff5ab15248a8611e6165a9449af30ca7fe206acff80a8bef179badf4100379dea18db8c94a3738bbf8c1847ec1b854159805c07
SSDEEP

192:jr0QjqirBzCL7eOIQSz16nbP3IwKu1AVxxlK4QzwU94aMVv0L:v0Q3rBWLmnz1MbvTKEAVk4QzwU9jA8L

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5954474519:AAEGnfW1mRvGRxq-zIAvwJfpKEbhLLiqVaM/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

Consulta de compra.exe

description pid process target process

PID 1472 set thread context of 1960 1472 Consulta de compra.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exeInstallUtil.exe

pid process

1256 powershell.exe
580 powershell.exe
1960 InstallUtil.exe
1960 InstallUtil.exe

description	pid	process	target process
PID 1472 set thread context of 1960	1472	Consulta de compra.exe	InstallUtil.exe

pid	process
1256	powershell.exe
580	powershell.exe
1960	InstallUtil.exe
1960	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exeConsulta de compra.exepowershell.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	1472	Consulta de compra.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	1960	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Consulta de compra.exe

description	pid	process	target process
PID 1472 wrote to memory of 1256	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 1256	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 1256	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 1256	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 580	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 580	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 580	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 580	1472	Consulta de compra.exe	powershell.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe
PID 1472 wrote to memory of 1960	1472	Consulta de compra.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\Consulta de compra.exe
"C:\Users\Admin\AppData\Local\Temp\Consulta de compra.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-Date
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANwAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
1149c9d42aa2d577086cd6c56a4fb3b0

SHA1
e9dfd630d2f99ff00134e98e677a732abf7a63ff

SHA256
09543b7674a5a7c80208262f7eff2411911a441822e894070e3501594444e79c

SHA512
aafbaf9230afc4db5f953536e7bc665f9770535f5ddcf3a37aa63b0ec36593e93c6b31b16a928e9635feb557828daefcae1d4f77fc0ebb326cd69d33b5efde58

Download Submit
memory/580-62-0x0000000000000000-mapping.dmp

Download
memory/580-67-0x000000006E080000-0x000000006E62B000-memory.dmp

Filesize
5.7MB

Download
memory/580-66-0x000000006E080000-0x000000006E62B000-memory.dmp

Filesize
5.7MB

Download
memory/580-65-0x000000006E080000-0x000000006E62B000-memory.dmp

Filesize
5.7MB

Download
memory/1256-60-0x000000006F020000-0x000000006F5CB000-memory.dmp

Filesize
5.7MB

Download
memory/1256-59-0x000000006F020000-0x000000006F5CB000-memory.dmp

Filesize
5.7MB

Download
memory/1256-58-0x000000006F020000-0x000000006F5CB000-memory.dmp

Filesize
5.7MB

Download
memory/1256-56-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1256-55-0x0000000000000000-mapping.dmp

Download
memory/1472-61-0x0000000006E50000-0x0000000007070000-memory.dmp

Filesize
2.1MB

Download
memory/1472-54-0x0000000000160000-0x0000000000178000-memory.dmp

Filesize
96KB

Download
memory/1960-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-74-0x0000000000437C0E-mapping.dmp

Download
memory/1960-76-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-78-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing