agenttesla | d9136458c333f03b11beaaec3388aa1bd3afad5b5f6920fa992b8e5c05b8c62b

General

Target

tmp.exe
Size

851KB
MD5

7ff571e8d43bdefd4fb9ca3177dfbc7e
SHA1

1cee0c951d9b2841bf6ab2b86abd3cd6d1a4210f
SHA256

d9136458c333f03b11beaaec3388aa1bd3afad5b5f6920fa992b8e5c05b8c62b
SHA512

6a1295835c574970eb5c7ef23f1b179216436c03dd5482ec84e9d58674dfe22c2f558514b5ad3e08cf7cb737b730a8d8ad1f125cf73b316a5049ebcae28b4157
SSDEEP

12288:CZUpZwdqiKnLWeFXwg71cAwV6rmo6f4oKcBsInfwDUXgZtEjHD/d92JTDAd:hpZG4XX33mo6fZKcBdNimnd92JTE

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1611551445:AAFDJ3yQMlB3zXJGib2_TFkq1jedBMj3GTw/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1684-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1684-73-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1684-75-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1684-77-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1684-78-0x0000000000AA0000-0x0000000000AE0000-memory.dmp	family_agenttesla
behavioral1/memory/1684-80-0x0000000000AA0000-0x0000000000AE0000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

tmp.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts tmp.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	tmp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe"	tmp.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1544 set thread context of 1684 1544 tmp.exe tmp.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1368 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

tmp.exetmp.exepowershell.exe

pid process

1544 tmp.exe
1544 tmp.exe
1684 tmp.exe
1684 tmp.exe
1316 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

tmp.exetmp.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1544 tmp.exe
Token: SeDebugPrivilege 1684 tmp.exe
Token: SeDebugPrivilege 1316 powershell.exe

description	pid	process	target process
PID 1544 set thread context of 1684	1544	tmp.exe	tmp.exe

pid	process
1368	schtasks.exe

pid	process
1544	tmp.exe
1544	tmp.exe
1684	tmp.exe
1684	tmp.exe
1316	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1544	tmp.exe
Token: SeDebugPrivilege	1684	tmp.exe
Token: SeDebugPrivilege	1316	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1544 wrote to memory of 1316	1544	tmp.exe	powershell.exe
PID 1544 wrote to memory of 1316	1544	tmp.exe	powershell.exe
PID 1544 wrote to memory of 1316	1544	tmp.exe	powershell.exe
PID 1544 wrote to memory of 1316	1544	tmp.exe	powershell.exe
PID 1544 wrote to memory of 1368	1544	tmp.exe	schtasks.exe
PID 1544 wrote to memory of 1368	1544	tmp.exe	schtasks.exe
PID 1544 wrote to memory of 1368	1544	tmp.exe	schtasks.exe
PID 1544 wrote to memory of 1368	1544	tmp.exe	schtasks.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe
PID 1544 wrote to memory of 1684	1544	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dyfYBBF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dyfYBBF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA2C6.tmp"
2⤵
- Creates scheduled task(s)
PID:1368

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA2C6.tmp
Filesize
1KB

MD5
f017ce3c5e0bd7ae585f3863ef6cb8a6

SHA1
0f586a9da526262781e1b500ae28b2bbef06e682

SHA256
3dbfcbfd23cd3330701d74a2f56f241368c1fcab87abc7085561df4026775cf5

SHA512
f3aeccb15b073a6ceb53cb27a5cd76c62f441fa70c8faf09777d96ad948716b475f217b40e5d431bb7aa076b3ccfce8c46fd3bc6487a1fd7d96bc92574b3a291

Download Submit
memory/1316-79-0x0000000002830000-0x0000000002870000-memory.dmp

Filesize
256KB

Download
memory/1544-55-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/1544-56-0x00000000003B0000-0x00000000003CC000-memory.dmp

Filesize
112KB

Download
memory/1544-57-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/1544-58-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/1544-59-0x0000000005700000-0x00000000057B6000-memory.dmp

Filesize
728KB

Download
memory/1544-65-0x0000000005160000-0x000000000519E000-memory.dmp

Filesize
248KB

Download
memory/1544-54-0x0000000001110000-0x00000000011EC000-memory.dmp

Filesize
880KB

Download
memory/1684-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1684-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-75-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-77-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-78-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download
memory/1684-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1684-80-0x0000000000AA0000-0x0000000000AE0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads