agenttesla | 4658e3fbdce008655176741c9d433fd3f42e79990c72fab345fbf5777b1cc291

General

Target

Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
Size

1.1MB
MD5

47b60cbad0166a779665d56fe5c03596
SHA1

28c9d7176ead66aa9aa4e9889d49e4576405bebf
SHA256

4658e3fbdce008655176741c9d433fd3f42e79990c72fab345fbf5777b1cc291
SHA512

03dbfda0a1f34ea8c8b59573723ebc9bebf2fa5c2aad6fd770a1c11537199fee25534865a23911b4279ea73537ded0f42f6faf270365ac4915fa9f882fa87328
SSDEEP

24576:Oc7wqlKtw+m21of1PW5ewsF9r3g62h/jOQlg5A7:l7wKJQoxwgbYJqQui

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
host39.registrar-servers.com
Port:
587
Username:
[email protected]
Password:
payment 12345

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe

description	pid	process	target process
PID 1056 set thread context of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1628 schtasks.exe

pid	process
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Request for Commercial offer - NGL 700800 Compressor Station Expansion.exeRequest for Commercial offer - NGL 700800 Compressor Station Expansion.exe

pid	process
1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
552	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
552	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request for Commercial offer - NGL 700800 Compressor Station Expansion.exeRequest for Commercial offer - NGL 700800 Compressor Station Expansion.exe

description	pid	process
Token: SeDebugPrivilege	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
Token: SeDebugPrivilege	552	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe

description	pid	process	target process
PID 1056 wrote to memory of 1628	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	schtasks.exe
PID 1056 wrote to memory of 1628	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	schtasks.exe
PID 1056 wrote to memory of 1628	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	schtasks.exe
PID 1056 wrote to memory of 1628	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	schtasks.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
PID 1056 wrote to memory of 552	1056	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe	Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe

C:\Users\Admin\AppData\Local\Temp\Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
"C:\Users\Admin\AppData\Local\Temp\Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qwoDNFjfLbLr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DD6.tmp"
2⤵
- Creates scheduled task(s)
PID:1628

C:\Users\Admin\AppData\Local\Temp\Request for Commercial offer - NGL 700800 Compressor Station Expansion.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:552

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9DD6.tmp
Filesize
1KB

MD5
cabb7d181372d989083d78745b644409

SHA1
7d8a6e0ffa8da832af466ddab90aba636607b7b8

SHA256
97482ea08a378aaa26c57ee1a7fefd31738c83359eaa1621fe66f913145191b4

SHA512
3d0b0020abbc3d6d7b295598b0d619dcc42e2595bd0790478316cff97a04cc203fc97da998a9e7ed1b6d696628a065965a18d8d477d5da95952cb9cee692bd96

Download Submit
memory/552-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-67-0x0000000000437C5E-mapping.dmp

Download
memory/552-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/552-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1056-54-0x0000000000CF0000-0x0000000000E16000-memory.dmp

Filesize
1.1MB

Download
memory/1056-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1056-56-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/1056-58-0x0000000005880000-0x0000000005900000-memory.dmp

Filesize
512KB

Download
memory/1056-57-0x0000000005A00000-0x0000000005AC8000-memory.dmp

Filesize
800KB

Download
memory/1628-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads