agenttesla | ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440

General

Target

ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
Size

829KB
MD5

5d1c9a1d3cf698d5388abbe8eeeb6aff
SHA1

0da3a5217e7072627b6111195933531869efc6a5
SHA256

ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440
SHA512

2dadc4a503cea21a4c669e1006a1deb15223a67aa8bcc4017c36c2ce9713fd2f508066e8bd3ad748e3ea03511109f08ef4baee1b293e1152904de750bb52233f
SSDEEP

12288:uWVrltW8G34/uK45+po2WLfpjF+ZDMlwtMrj9pQkS5uy3x9IUONe:5o34/up+pJspMZwltVS1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
premium162.web-hosting.com
Port:
587
Username:
[email protected]
Password:
Success4sure2day10@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2708 schtasks.exe

pid	process
2708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe

pid	process
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe

description pid process

Token: SeDebugPrivilege 2548 ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe

description	pid	process
Token: SeDebugPrivilege	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe

description	pid	process	target process
PID 2548 wrote to memory of 2372	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2372	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2372	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2372	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2656	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2656	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2656	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2656	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	powershell.exe
PID 2548 wrote to memory of 2708	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	schtasks.exe
PID 2548 wrote to memory of 2708	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	schtasks.exe
PID 2548 wrote to memory of 2708	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	schtasks.exe
PID 2548 wrote to memory of 2708	2548	ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
"C:\Users\Admin\AppData\Local\Temp\ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe"
2⤵
PID:2372

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cUHdWvnGiS.exe"
2⤵
PID:2656

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cUHdWvnGiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD153.tmp"
2⤵
- Creates scheduled task(s)
PID:2708

C:\Users\Admin\AppData\Local\Temp\ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe
"C:\Users\Admin\AppData\Local\Temp\ca97a62dd58689169538195a343e2c216d537d107a66c8d8b6aa82d929224440.exe"
2⤵
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD153.tmp

Filesize
1KB

MD5
73b9a67b7fda66176ac79ed38f8b8290

SHA1
d49cb0152b809f7476190ec5ea4b4b46ab1fd44c

SHA256
c2fad3d3d96322ff829f215bb4e32c247110edf1c25f3d09875007f21a696813

SHA512
3b11f0f8b55394482726040d5cdcb5892d0f57362f52ea9f5a8b2d2c57893febb44df3520fa0a565f03832631a5f6786c75dba70ab322990e8515c7c080d12c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4A47IM7XDVBBB4UO2G1E.temp

Filesize
7KB

MD5
ff6d65d57bbc78e22fcea41c4045d773

SHA1
1873321a3a736cd03dc328deb125900d8f26e8bf

SHA256
7ee4453d1841b9882d261ea18e09d65f67a3494fcd354f926ec2c3f64397880b

SHA512
3c39df5056a4d7685e6adf9bfc5fa990c86707cdfa2f6e5a4766c656cbf5b53dfb0879a760279847e25fc11d700aace73c8e50a854cfd98bc6a23b308870911d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ff6d65d57bbc78e22fcea41c4045d773

SHA1
1873321a3a736cd03dc328deb125900d8f26e8bf

SHA256
7ee4453d1841b9882d261ea18e09d65f67a3494fcd354f926ec2c3f64397880b

SHA512
3c39df5056a4d7685e6adf9bfc5fa990c86707cdfa2f6e5a4766c656cbf5b53dfb0879a760279847e25fc11d700aace73c8e50a854cfd98bc6a23b308870911d

Download Submit
memory/1696-44-0x0000000072CA0000-0x000000007338E000-memory.dmp

Filesize
6.9MB

Download
memory/1696-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-49-0x0000000072CA0000-0x000000007338E000-memory.dmp

Filesize
6.9MB

Download
memory/1696-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1696-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1696-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2372-38-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/2372-43-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/2372-47-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/2372-45-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/2372-39-0x00000000026A0000-0x00000000026E0000-memory.dmp

Filesize
256KB

Download
memory/2372-40-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/2548-1-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2548-8-0x00000000010E0000-0x0000000001120000-memory.dmp

Filesize
256KB

Download
memory/2548-6-0x0000000005220000-0x000000000529C000-memory.dmp

Filesize
496KB

Download
memory/2548-5-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/2548-35-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2548-0-0x0000000001150000-0x0000000001226000-memory.dmp

Filesize
856KB

Download
memory/2548-7-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2548-4-0x00000000007E0000-0x00000000007E8000-memory.dmp

Filesize
32KB

Download
memory/2548-2-0x00000000010E0000-0x0000000001120000-memory.dmp

Filesize
256KB

Download
memory/2548-3-0x00000000009C0000-0x00000000009D8000-memory.dmp

Filesize
96KB

Download
memory/2656-48-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-41-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-42-0x0000000002BA0000-0x0000000002BE0000-memory.dmp

Filesize
256KB

Download
memory/2656-46-0x0000000002BA0000-0x0000000002BE0000-memory.dmp

Filesize
256KB

Download
memory/2656-37-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads