agenttesla | 512041d2cf26aa8cdd11e5c0edd3a5047e887d18204e554875026ae850a49ffe

General

Target

31072022-2.exe
Size

757KB
MD5

865ffbbf9721906c2f4802622261d34c
SHA1

04c04fb395f15820a5b22b6a5d0b377d04d95f98
SHA256

512041d2cf26aa8cdd11e5c0edd3a5047e887d18204e554875026ae850a49ffe
SHA512

84077e4b14367d5198b1d43a89963313395569fc3996dde3d04b693aabeccb0ae4dd055f7b51d5111e261ebde5d5188d2cff5dd4b6ed7606afa12ee538805c09
SSDEEP

12288:8wlhmomPZefBT2BRF0DKTNOJrKvG4R+0/kkUpsixfmAWwPtqvyuP/F:IomxiBT2BRF0CNO0vb+kUp5nnQFXF

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1611551445:AAFDJ3yQMlB3zXJGib2_TFkq1jedBMj3GTw/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1568-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1568-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1568-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1568-70-0x000000000043772E-mapping.dmp	family_agenttesla
behavioral1/memory/1568-74-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1568-72-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

31072022-2.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts 31072022-2.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	31072022-2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

31072022-2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe"	31072022-2.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

31072022-2.exe

description pid process target process

PID 1452 set thread context of 1568 1452 31072022-2.exe 31072022-2.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1772 schtasks.exe

description	pid	process	target process
PID 1452 set thread context of 1568	1452	31072022-2.exe	31072022-2.exe

pid	process
1772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

31072022-2.exe31072022-2.exepowershell.exe

pid	process
1452	31072022-2.exe
1452	31072022-2.exe
1452	31072022-2.exe
1452	31072022-2.exe
1452	31072022-2.exe
1452	31072022-2.exe
1452	31072022-2.exe
1568	31072022-2.exe
1568	31072022-2.exe
1872	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

31072022-2.exe31072022-2.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1452 31072022-2.exe
Token: SeDebugPrivilege 1568 31072022-2.exe
Token: SeDebugPrivilege 1872 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1452	31072022-2.exe
Token: SeDebugPrivilege	1568	31072022-2.exe
Token: SeDebugPrivilege	1872	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

31072022-2.exe

description	pid	process	target process
PID 1452 wrote to memory of 1872	1452	31072022-2.exe	powershell.exe
PID 1452 wrote to memory of 1872	1452	31072022-2.exe	powershell.exe
PID 1452 wrote to memory of 1872	1452	31072022-2.exe	powershell.exe
PID 1452 wrote to memory of 1872	1452	31072022-2.exe	powershell.exe
PID 1452 wrote to memory of 1772	1452	31072022-2.exe	schtasks.exe
PID 1452 wrote to memory of 1772	1452	31072022-2.exe	schtasks.exe
PID 1452 wrote to memory of 1772	1452	31072022-2.exe	schtasks.exe
PID 1452 wrote to memory of 1772	1452	31072022-2.exe	schtasks.exe
PID 1452 wrote to memory of 1564	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1564	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1564	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1564	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe
PID 1452 wrote to memory of 1568	1452	31072022-2.exe	31072022-2.exe

C:\Users\Admin\AppData\Local\Temp\31072022-2.exe
"C:\Users\Admin\AppData\Local\Temp\31072022-2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jPjTWeqDDTDx.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jPjTWeqDDTDx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAED6.tmp"
2⤵
- Creates scheduled task(s)
PID:1772

C:\Users\Admin\AppData\Local\Temp\31072022-2.exe
"C:\Users\Admin\AppData\Local\Temp\31072022-2.exe"
2⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\31072022-2.exe
"C:\Users\Admin\AppData\Local\Temp\31072022-2.exe"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAED6.tmp
Filesize
1KB

MD5
3a8d9ef7b5cd23661a6381b22696dfa8

SHA1
7522ead923c8e7c21ef8a1ca98bbfb1426923c16

SHA256
df66f143c7de3803095cdcd19f269d1ed3b3a9512d14402ffedee2447aa95537

SHA512
93ab971c5a203aa0e5a483d933c23074b35bcc9d3a16736dbc4996cc99911bb367a158a4f411d3b080e95e2fe69c9dcac6665625b5c1ee7b14715004662a8137

Download Submit
memory/1452-63-0x0000000004950000-0x0000000004998000-memory.dmp

Filesize
288KB

Download
memory/1452-55-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1452-56-0x00000000005C0000-0x00000000005DA000-memory.dmp

Filesize
104KB

Download
memory/1452-58-0x0000000005CD0000-0x0000000005D50000-memory.dmp

Filesize
512KB

Download
memory/1452-57-0x00000000005A0000-0x00000000005AE000-memory.dmp

Filesize
56KB

Download
memory/1452-54-0x00000000001A0000-0x0000000000262000-memory.dmp

Filesize
776KB

Download
memory/1568-70-0x000000000043772E-mapping.dmp

Download
memory/1568-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1568-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1568-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1568-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1568-74-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1568-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1568-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1772-60-0x0000000000000000-mapping.dmp

Download
memory/1872-77-0x000000006EF00000-0x000000006F4AB000-memory.dmp

Filesize
5.7MB

Download
memory/1872-59-0x0000000000000000-mapping.dmp

Download
memory/1872-75-0x000000006EF00000-0x000000006F4AB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads