agenttesla | 502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3

General

Target

502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe
Size

1008KB
MD5

3521aff033bea60a6e8869378b9d068c
SHA1

9d84d60857b499e6c6c13d684e67f11f6d8ca31a
SHA256

502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3
SHA512

98f3c653b2a763ffa72aa0873f760e06221428066a2f8dc9fcf4c5ecc620684acbf572518057b6c9eac952587d14f033bc9648531cfb0e97f68be86588310e8b
SSDEEP

24576:Bqas+pJyCkF0ODvYHkAduLZgBGROSYOmT7Lmte9:wyJyCkF9VAd4ZgBG4SYOy7

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
Kene123456789
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe

description	pid	process	target process
PID 2960 set thread context of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3000 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RegSvcs.exepowershell.exepowershell.exe

pid process

2508 RegSvcs.exe
2508 RegSvcs.exe
2648 powershell.exe
2232 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RegSvcs.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2508 RegSvcs.exe
Token: SeDebugPrivilege 2648 powershell.exe
Token: SeDebugPrivilege 2232 powershell.exe

pid	process
3000	schtasks.exe

pid	process
2508	RegSvcs.exe
2508	RegSvcs.exe
2648	powershell.exe
2232	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2508	RegSvcs.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe

description	pid	process	target process
PID 2960 wrote to memory of 2648	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 2648	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 2648	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 2648	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 2232	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 2232	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 2232	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 2232	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	powershell.exe
PID 2960 wrote to memory of 3000	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	schtasks.exe
PID 2960 wrote to memory of 3000	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	schtasks.exe
PID 2960 wrote to memory of 3000	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	schtasks.exe
PID 2960 wrote to memory of 3000	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	schtasks.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe
PID 2960 wrote to memory of 2508	2960	502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe
"C:\Users\Admin\AppData\Local\Temp\502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\502d7ec69173cc68e242caf59956a90e519dad247b118c60394be96c9474f2d3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kVDWrSDRqNaAK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kVDWrSDRqNaAK" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE753.tmp"
2⤵
- Creates scheduled task(s)
PID:3000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE753.tmp

Filesize
1KB

MD5
fdcc2b7bf383e49a4f88901a9117ec93

SHA1
5fd5b5b59ec0ac8ea634455f1d20c489d4e3940c

SHA256
15d346772415d6fc4944758a9d8a6e45233a2601e8b7a3ef0c4249a49f39f2b7

SHA512
fdf223919c703a386e68b5a324372f64b80425eea9676c09cbb8ae3705e3d0558e096a0b0e200158eacdd589d70fbf860e9641a66b831ddf03e30c702253eb22

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RUSJGXDU0RQ9OJ945GIO.temp

Filesize
7KB

MD5
1e86916d7feacecdf54efc4b9e9aedc5

SHA1
507368b5723ae81cf93efd0560b5d73657a505ea

SHA256
b7c64a0ae4089685cc42e86b36aa1c5eead245e677376bb9d37363b10c9aa44c

SHA512
584c61b299d6aa038f160f8fbd90d1c974d32f19e77bdf467a5beeb9d40851ef46a31d68ba93c4a4d935ed1096b94f10cc2bddf27b1df09fb72bc2088dc74406

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1e86916d7feacecdf54efc4b9e9aedc5

SHA1
507368b5723ae81cf93efd0560b5d73657a505ea

SHA256
b7c64a0ae4089685cc42e86b36aa1c5eead245e677376bb9d37363b10c9aa44c

SHA512
584c61b299d6aa038f160f8fbd90d1c974d32f19e77bdf467a5beeb9d40851ef46a31d68ba93c4a4d935ed1096b94f10cc2bddf27b1df09fb72bc2088dc74406

Download Submit
memory/2232-33-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2232-25-0x000000006F910000-0x000000006FEBB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-44-0x000000006F910000-0x000000006FEBB000-memory.dmp

Filesize
5.7MB

Download
memory/2232-43-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2232-35-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2508-42-0x0000000004810000-0x0000000004850000-memory.dmp

Filesize
256KB

Download
memory/2508-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-41-0x0000000073790000-0x0000000073E7E000-memory.dmp

Filesize
6.9MB

Download
memory/2508-37-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2508-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-46-0x0000000073790000-0x0000000073E7E000-memory.dmp

Filesize
6.9MB

Download
memory/2508-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-47-0x0000000004810000-0x0000000004850000-memory.dmp

Filesize
256KB

Download
memory/2508-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2648-27-0x0000000002530000-0x0000000002570000-memory.dmp

Filesize
256KB

Download
memory/2648-30-0x000000006F910000-0x000000006FEBB000-memory.dmp

Filesize
5.7MB

Download
memory/2648-45-0x000000006F910000-0x000000006FEBB000-memory.dmp

Filesize
5.7MB

Download
memory/2648-22-0x000000006F910000-0x000000006FEBB000-memory.dmp

Filesize
5.7MB

Download
memory/2960-6-0x0000000005CA0000-0x0000000005D1C000-memory.dmp

Filesize
496KB

Download
memory/2960-20-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2960-7-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2960-38-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download
memory/2960-5-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/2960-4-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/2960-3-0x0000000000510000-0x0000000000528000-memory.dmp

Filesize
96KB

Download
memory/2960-0-0x0000000001000000-0x0000000001102000-memory.dmp

Filesize
1.0MB

Download
memory/2960-2-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/2960-1-0x0000000074A90000-0x000000007517E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads