agenttesla | 547d0af27bc22295ec106d1fc53d2a844e9c7c88319ea5aebca952375d6654ee

General

Target

SSC040802 船舶规范Ship particular.exe
Size

676KB
MD5

7170dc58bd3329c956d7397e49c11aad
SHA1

b5aff2a6c1bd9836a83f96527815e1730afd3e1d
SHA256

547d0af27bc22295ec106d1fc53d2a844e9c7c88319ea5aebca952375d6654ee
SHA512

b189abf0550c73e2ed0534ef89dc653ef277129a4e06381c947c2385d54b7d09f3993a27531c7f79d05f629843c5a94edea0249c9df9b1e194a905bbbf003f02
SSDEEP

12288:yvd6JGjIxZfszAuURYpwTTBX5/Pr0b0B4dwXp2cMKb+7L7a0Ny:Yd6JGqZf4C7xRPreAiyaL7Fk

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mgsales.net
Port:
587
Username:
[email protected]
Password:
.L&tA{$_f4+t
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

SSC040802 船舶规范Ship particular.exe

description pid process target process

PID 1720 set thread context of 2712 1720 SSC040802 船舶规范Ship particular.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2984 schtasks.exe

description	pid	process	target process
PID 1720 set thread context of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe

pid	process
2984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

SSC040802 船舶规范Ship particular.exepowershell.exepowershell.exeRegSvcs.exe

pid	process
1720	SSC040802 船舶规范Ship particular.exe
1720	SSC040802 船舶规范Ship particular.exe
1732	powershell.exe
2540	powershell.exe
1720	SSC040802 船舶规范Ship particular.exe
2712	RegSvcs.exe
2712	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SSC040802 船舶规范Ship particular.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1720	SSC040802 船舶规范Ship particular.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2712	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

SSC040802 船舶规范Ship particular.exe

description	pid	process	target process
PID 1720 wrote to memory of 1732	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 1732	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 1732	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 1732	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 2540	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 2540	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 2540	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 2540	1720	SSC040802 船舶规范Ship particular.exe	powershell.exe
PID 1720 wrote to memory of 2984	1720	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 1720 wrote to memory of 2984	1720	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 1720 wrote to memory of 2984	1720	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 1720 wrote to memory of 2984	1720	SSC040802 船舶规范Ship particular.exe	schtasks.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe
PID 1720 wrote to memory of 2712	1720	SSC040802 船舶规范Ship particular.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SSC040802 船舶规范Ship particular.exe
"C:\Users\Admin\AppData\Local\Temp\SSC040802 船舶规范Ship particular.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SSC040802 船舶规范Ship particular.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KvUZbUdroagkZ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KvUZbUdroagkZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F58.tmp"
2⤵
- Creates scheduled task(s)
PID:2984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4F58.tmp

Filesize
1KB

MD5
75c7ea1d5e2ac7bab06f94a2e9311209

SHA1
1511cce2ad4a55570957f43256d09598d3b62909

SHA256
77c58cf94c0015a0c4b4b84f9f01eb2116106977030c7e38f2d6c797eaa93080

SHA512
7c09229062b8acc097a0ae3f9c62eb95d423b190569aab57adcdccc693ffb47a50138fa8b28a28dae5dc9aeccd5d5dad7edaf9487eea47f116ed026b42ec0921

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\27DSTASS1SUWQ8EXJHUC.temp

Filesize
7KB

MD5
e6a7eb6437c7bca59c23bd0cf8d690e2

SHA1
b9e7def9085b44cab9e792f5d8b197a3a93a1e4a

SHA256
c480b9812dc2fc9efed8bdd5fb6a479f06d0cbe29bea3e138e0ee7e3063e0bf0

SHA512
1e89b0e5d448d05b0ab59e375b87770ccea9b158979647c99f49606a9dd5d3a84d28b46a2fcefe6a49c211dd6e9ba1ef7912d78a37a449eaab5ff9281d1a05b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
e6a7eb6437c7bca59c23bd0cf8d690e2

SHA1
b9e7def9085b44cab9e792f5d8b197a3a93a1e4a

SHA256
c480b9812dc2fc9efed8bdd5fb6a479f06d0cbe29bea3e138e0ee7e3063e0bf0

SHA512
1e89b0e5d448d05b0ab59e375b87770ccea9b158979647c99f49606a9dd5d3a84d28b46a2fcefe6a49c211dd6e9ba1ef7912d78a37a449eaab5ff9281d1a05b9

Download Submit
memory/1720-36-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/1720-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/1720-30-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/1720-6-0x0000000004EB0000-0x0000000004F2A000-memory.dmp

Filesize
488KB

Download
memory/1720-5-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/1720-2-0x00000000043C0000-0x0000000004400000-memory.dmp

Filesize
256KB

Download
memory/1720-0-0x0000000000210000-0x00000000002BE000-memory.dmp

Filesize
696KB

Download
memory/1720-3-0x00000000004E0000-0x00000000004F6000-memory.dmp

Filesize
88KB

Download
memory/1720-4-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/1732-19-0x000000006F560000-0x000000006FB0B000-memory.dmp

Filesize
5.7MB

Download
memory/1732-22-0x0000000002880000-0x00000000028C0000-memory.dmp

Filesize
256KB

Download
memory/1732-32-0x0000000002880000-0x00000000028C0000-memory.dmp

Filesize
256KB

Download
memory/1732-26-0x000000006F560000-0x000000006FB0B000-memory.dmp

Filesize
5.7MB

Download
memory/1732-28-0x0000000002880000-0x00000000028C0000-memory.dmp

Filesize
256KB

Download
memory/1732-38-0x000000006F560000-0x000000006FB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-20-0x000000006F560000-0x000000006FB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-24-0x000000006F560000-0x000000006FB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-37-0x000000006F560000-0x000000006FB0B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-21-0x00000000029D0000-0x0000000002A10000-memory.dmp

Filesize
256KB

Download
memory/2712-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2712-34-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-39-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-42-0x0000000074990000-0x000000007507E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-43-0x0000000074990000-0x000000007507E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-44-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads