agenttesla | bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4

General

Target

bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
Size

655KB
MD5

f11ed191214d6fb26bdd687b7847c1a1
SHA1

8e44fb94453b349d09189d011742f89e92d802f6
SHA256

bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4
SHA512

df2e8bd1b24f0487b39f62e32de3ae3acec6899f51f3606202b413c0b72150216aa41f4536f90222ad6fadc33852eea8e5a553937310f8d650f4ba566c41d934
SSDEEP

12288:Rc45+po2gO7RxwIFloBuBgMdACo3S6LtX2OIyqiMAxyX:Rf+pJg8RFluYgbCoiXbyqAxyX

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
94.156.71.128
Port:
21
Username:
sysuser
Password:
bXcj980_6__!!##8290

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://94.156.71.128
Port:
21
Username:
sysuser
Password:
bXcj980_6__!!##8290

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2792 schtasks.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

pid	process
2792	schtasks.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe

description	pid	process	target process
PID 876 wrote to memory of 2764	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	powershell.exe
PID 876 wrote to memory of 2764	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	powershell.exe
PID 876 wrote to memory of 2764	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	powershell.exe
PID 876 wrote to memory of 2764	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	powershell.exe
PID 876 wrote to memory of 2792	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	schtasks.exe
PID 876 wrote to memory of 2792	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	schtasks.exe
PID 876 wrote to memory of 2792	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	schtasks.exe
PID 876 wrote to memory of 2792	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	schtasks.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
PID 876 wrote to memory of 2140	876	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe	bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe

C:\Users\Admin\AppData\Local\Temp\bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
"C:\Users\Admin\AppData\Local\Temp\bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ugEnJnl.exe"
2⤵
PID:2764

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ugEnJnl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8F93.tmp"
2⤵
- Creates scheduled task(s)
PID:2792

C:\Users\Admin\AppData\Local\Temp\bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe
"C:\Users\Admin\AppData\Local\Temp\bf749c87470bbd88818b2998e606b4d36aeb2f701cd8f1f5577ffd922af66ba4.exe"
2⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8F93.tmp

Filesize
1KB

MD5
828933dd742cc287fb8c3edd27803c99

SHA1
f8b73a0e182e17c86e1f9327801ac82bea914295

SHA256
cb29de48106f54cfaa209aa67908908b6654735c9af89c7de6f713acb0f7a2bf

SHA512
d9fbf65ef48c27b4846362240073287863542b37f5489b364509c9437f32c132d06611f926af1efc7429fdf1ec76cfb25460da1573b38639f664ec3234b2757b

Download Submit
memory/876-0-0x0000000000FD0000-0x0000000001078000-memory.dmp

Filesize
672KB

Download
memory/876-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/876-2-0x0000000000D50000-0x0000000000D90000-memory.dmp

Filesize
256KB

Download
memory/876-3-0x0000000000300000-0x0000000000318000-memory.dmp

Filesize
96KB

Download
memory/876-4-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/876-5-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/876-6-0x0000000000D50000-0x0000000000D90000-memory.dmp

Filesize
256KB

Download
memory/876-7-0x0000000004BC0000-0x0000000004C3C000-memory.dmp

Filesize
496KB

Download
memory/876-23-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2140-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2140-25-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2140-14-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2140-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2140-20-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2140-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2140-22-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2140-15-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2140-29-0x0000000000550000-0x0000000000590000-memory.dmp

Filesize
256KB

Download
memory/2140-28-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2140-35-0x0000000000550000-0x0000000000590000-memory.dmp

Filesize
256KB

Download
memory/2140-34-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2764-32-0x00000000002C0000-0x0000000000300000-memory.dmp

Filesize
256KB

Download
memory/2764-33-0x0000000070590000-0x0000000070B3B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-31-0x0000000070590000-0x0000000070B3B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-30-0x0000000070590000-0x0000000070B3B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads