agenttesla | 725c43344564a051e58bc34bc3d2d54df05a2eb8edf522be7f0eba70087d3094

General

Target

Hesaphareketi-0.exe
Size

792KB
MD5

5cd7722aadafdc8813169f79fe26cd15
SHA1

a6eb9a2e6333bbcfce98d68764467e1c82b1d093
SHA256

725c43344564a051e58bc34bc3d2d54df05a2eb8edf522be7f0eba70087d3094
SHA512

98bd21cc932dc37f1fc71c8155c19c9c06eaf19cde32a8b0d9855249791bf2493aec95f5925f3c6b402f30e707689cb8e5bfa6540601c5072cf1583b808e985e
SSDEEP

12288:dhm1E6jD/paxJVZJToapvT/8uJ+nW9Kja0JTDYEy7P3ATsNcrZXY+opoxx:3m1tD/paxJNfvTUK+nagbmyZ/e

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.defalife.com.tr
Port:
587
Username:
[email protected]
Password:
Defalife.124578
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

Hesaphareketi-0.exe

description pid process target process

PID 2116 set thread context of 2844 2116 Hesaphareketi-0.exe Hesaphareketi-0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2776 schtasks.exe

description	pid	process	target process
PID 2116 set thread context of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe

pid	process
2776	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

Hesaphareketi-0.exeHesaphareketi-0.exepowershell.exe

pid	process
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2116	Hesaphareketi-0.exe
2844	Hesaphareketi-0.exe
2844	Hesaphareketi-0.exe
2800	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Hesaphareketi-0.exeHesaphareketi-0.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2116	Hesaphareketi-0.exe
Token: SeDebugPrivilege	2844	Hesaphareketi-0.exe
Token: SeDebugPrivilege	2800	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

Hesaphareketi-0.exe

description	pid	process	target process
PID 2116 wrote to memory of 2800	2116	Hesaphareketi-0.exe	powershell.exe
PID 2116 wrote to memory of 2800	2116	Hesaphareketi-0.exe	powershell.exe
PID 2116 wrote to memory of 2800	2116	Hesaphareketi-0.exe	powershell.exe
PID 2116 wrote to memory of 2800	2116	Hesaphareketi-0.exe	powershell.exe
PID 2116 wrote to memory of 2776	2116	Hesaphareketi-0.exe	schtasks.exe
PID 2116 wrote to memory of 2776	2116	Hesaphareketi-0.exe	schtasks.exe
PID 2116 wrote to memory of 2776	2116	Hesaphareketi-0.exe	schtasks.exe
PID 2116 wrote to memory of 2776	2116	Hesaphareketi-0.exe	schtasks.exe
PID 2116 wrote to memory of 2264	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2264	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2264	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2264	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2676	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2676	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2676	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2676	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe
PID 2116 wrote to memory of 2844	2116	Hesaphareketi-0.exe	Hesaphareketi-0.exe

C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe
"C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IkOxCvUqGPou.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IkOxCvUqGPou" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB828.tmp"
2⤵
- Creates scheduled task(s)
PID:2776

C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe
"C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe"
2⤵
PID:2264

C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe
"C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe"
2⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe
"C:\Users\Admin\AppData\Local\Temp\Hesaphareketi-0.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB828.tmp

Filesize
1KB

MD5
3ad5413c66415e502a28c24a948fbc91

SHA1
87549eeab46545253f5875d86d5b2cdf2659b4c3

SHA256
9e36d0cc8314491ebd42431d156aa1a30545c4c1cb2a8edab01c570b92c6e326

SHA512
e0d18485f518cbe583de0886bad55a866402dbdf5668e090bbc83e57526eabe443a45826f0021f6279cbdbaa22296fe8121658329470e0a34a4d8889be16e4a5

Download Submit
memory/2116-26-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2116-0-0x0000000000C10000-0x0000000000CDC000-memory.dmp

Filesize
816KB

Download
memory/2116-2-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/2116-3-0x00000000009A0000-0x00000000009B8000-memory.dmp

Filesize
96KB

Download
memory/2116-4-0x0000000000500000-0x0000000000506000-memory.dmp

Filesize
24KB

Download
memory/2116-5-0x00000000005D0000-0x00000000005DA000-memory.dmp

Filesize
40KB

Download
memory/2116-6-0x0000000004F70000-0x0000000004FEA000-memory.dmp

Filesize
488KB

Download
memory/2116-7-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2116-8-0x0000000004D80000-0x0000000004DC0000-memory.dmp

Filesize
256KB

Download
memory/2116-1-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2800-34-0x0000000074540000-0x0000000074AEB000-memory.dmp

Filesize
5.7MB

Download
memory/2800-37-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2800-38-0x0000000074540000-0x0000000074AEB000-memory.dmp

Filesize
5.7MB

Download
memory/2800-36-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2800-33-0x0000000074540000-0x0000000074AEB000-memory.dmp

Filesize
5.7MB

Download
memory/2844-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-32-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/2844-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-35-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download
memory/2844-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2844-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-39-0x0000000073310000-0x00000000739FE000-memory.dmp

Filesize
6.9MB

Download
memory/2844-40-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads