agenttesla | 547d0af27bc22295ec106d1fc53d2a844e9c7c88319ea5aebca952375d6654ee

General

Target

SSC040802 船舶规范Ship particular.exe
Size

676KB
MD5

7170dc58bd3329c956d7397e49c11aad
SHA1

b5aff2a6c1bd9836a83f96527815e1730afd3e1d
SHA256

547d0af27bc22295ec106d1fc53d2a844e9c7c88319ea5aebca952375d6654ee
SHA512

b189abf0550c73e2ed0534ef89dc653ef277129a4e06381c947c2385d54b7d09f3993a27531c7f79d05f629843c5a94edea0249c9df9b1e194a905bbbf003f02
SSDEEP

12288:yvd6JGjIxZfszAuURYpwTTBX5/Pr0b0B4dwXp2cMKb+7L7a0Ny:Yd6JGqZf4C7xRPreAiyaL7Fk

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mgsales.net
Port:
587
Username:
[email protected]
Password:
.L&tA{$_f4+t
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

SSC040802 船舶规范Ship particular.exe

description pid process target process

PID 2584 set thread context of 1084 2584 SSC040802 船舶规范Ship particular.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2412 schtasks.exe

description	pid	process	target process
PID 2584 set thread context of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe

pid	process
2412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

SSC040802 船舶规范Ship particular.exepowershell.exepowershell.exeRegSvcs.exe

pid	process
2584	SSC040802 船舶规范Ship particular.exe
2584	SSC040802 船舶规范Ship particular.exe
2584	SSC040802 船舶规范Ship particular.exe
2712	powershell.exe
2752	powershell.exe
2584	SSC040802 船舶规范Ship particular.exe
1084	RegSvcs.exe
1084	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SSC040802 船舶规范Ship particular.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2584	SSC040802 船舶规范Ship particular.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	1084	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

SSC040802 船舶规范Ship particular.exe

description	pid	process	target process
PID 2584 wrote to memory of 2712	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2712	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2712	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2712	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2752	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2752	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2752	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2752	2584	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 2584 wrote to memory of 2412	2584	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 2584 wrote to memory of 2412	2584	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 2584 wrote to memory of 2412	2584	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 2584 wrote to memory of 2412	2584	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 2584 wrote to memory of 1084	2584	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SSC040802 船舶规范Ship particular.exe
"C:\Users\Admin\AppData\Local\Temp\SSC040802 船舶规范Ship particular.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SSC040802 船舶规范Ship particular.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KvUZbUdroagkZ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KvUZbUdroagkZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9389.tmp"
2⤵
- Creates scheduled task(s)
PID:2412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9389.tmp

Filesize
1KB

MD5
20eff0d145a2e25b581a2acee1fd898f

SHA1
38096df82539022d3b6c256a23d5a8aa79f5cf90

SHA256
0f6b4c157fa0a23db4aabdc78ea4c84595dc353c988a401fbc0a96133fb7eff3

SHA512
30b58f55dca748a58c4dca6e7bb7032f13624e45aee690aa0cdb041e5c1c38892f837f5a99d8bb87be18d95b3fc3239ef104c823de48637f94a16891f37e4b28

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4B1YJVV24WB9BDW99GOR.temp

Filesize
7KB

MD5
0b8ac69ef83d8df2d97594470ac2e8fe

SHA1
2299896ee7f1d3f3b900eea74fe4a87555298758

SHA256
e0d47300ea61972217a1e0eaff32dcd2696754aa11bbfdc6894ccee1ed891b5f

SHA512
7345d0673a28c07f877164c41b19ff165f52b8fa9e8539c37dfda0fa46de3d17367c26cc68c49cb0f226b7a4e8fc0bd63930d028413979c3354dcfc8760b307e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
0b8ac69ef83d8df2d97594470ac2e8fe

SHA1
2299896ee7f1d3f3b900eea74fe4a87555298758

SHA256
e0d47300ea61972217a1e0eaff32dcd2696754aa11bbfdc6894ccee1ed891b5f

SHA512
7345d0673a28c07f877164c41b19ff165f52b8fa9e8539c37dfda0fa46de3d17367c26cc68c49cb0f226b7a4e8fc0bd63930d028413979c3354dcfc8760b307e

Download Submit
memory/1084-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-42-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-38-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1084-34-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1084-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2584-19-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2584-3-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/2584-5-0x00000000004B0000-0x00000000004BA000-memory.dmp

Filesize
40KB

Download
memory/2584-43-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2584-6-0x0000000004E70000-0x0000000004EEA000-memory.dmp

Filesize
488KB

Download
memory/2584-2-0x00000000012C0000-0x0000000001300000-memory.dmp

Filesize
256KB

Download
memory/2584-27-0x00000000012C0000-0x0000000001300000-memory.dmp

Filesize
256KB

Download
memory/2584-1-0x0000000074780000-0x0000000074E6E000-memory.dmp

Filesize
6.9MB

Download
memory/2584-0-0x0000000001310000-0x00000000013BE000-memory.dmp

Filesize
696KB

Download
memory/2584-4-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download
memory/2712-20-0x000000006F650000-0x000000006FBFB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-23-0x0000000002420000-0x0000000002460000-memory.dmp

Filesize
256KB

Download
memory/2712-26-0x0000000002420000-0x0000000002460000-memory.dmp

Filesize
256KB

Download
memory/2712-24-0x0000000002420000-0x0000000002460000-memory.dmp

Filesize
256KB

Download
memory/2712-45-0x000000006F650000-0x000000006FBFB000-memory.dmp

Filesize
5.7MB

Download
memory/2752-25-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2752-21-0x000000006F650000-0x000000006FBFB000-memory.dmp

Filesize
5.7MB

Download
memory/2752-22-0x0000000002600000-0x0000000002640000-memory.dmp

Filesize
256KB

Download
memory/2752-44-0x000000006F650000-0x000000006FBFB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads