agenttesla | 7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220a

General

Target

7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
Size

1008KB
MD5

c556abc2e04d6889cf0a059f9133af60
SHA1

80d768a65c200d34517bdf788e8ae649e4f4addf
SHA256

7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220a
SHA512

1b766194cf4c7419366f9c05d1ba58ead14413125ce309825d4cd607edb4cb49bee7d4af46397df9d9bf27ea3418d96f642932ef068ea403f89a91b7e29162f7
SSDEEP

24576:p1tk+pJ16fvFeZ81CAH9ddcuq+vHWH32M4L:rZJUf9HH9Euqn32r

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.worlorderbillions.top
Port:
587
Username:
[email protected]
Password:
vqpF.#;cCodu
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe

description	pid	process	target process
PID 2932 set thread context of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe

pid	process
3068	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
3068	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2492 AcroRd32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe

description pid process

Token: SeDebugPrivilege 3068 7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

AcroRd32.exe

pid process

2492 AcroRd32.exe
2492 AcroRd32.exe
2492 AcroRd32.exe
2492 AcroRd32.exe

pid	process
2492	AcroRd32.exe

description	pid	process
Token: SeDebugPrivilege	3068	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe

pid	process
2492	AcroRd32.exe
2492	AcroRd32.exe
2492	AcroRd32.exe
2492	AcroRd32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe

description	pid	process	target process
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 2932 wrote to memory of 3068	2932	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
PID 3068 wrote to memory of 2492	3068	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	AcroRd32.exe
PID 3068 wrote to memory of 2492	3068	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	AcroRd32.exe
PID 3068 wrote to memory of 2492	3068	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	AcroRd32.exe
PID 3068 wrote to memory of 2492	3068	7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
"C:\Users\Admin\AppData\Local\Temp\7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2932

C:\Users\Admin\AppData\Local\Temp\7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe
"C:\Users\Admin\AppData\Local\Temp\7313bba3ca9b2518cc049ad47ab159f47675c0199fc812b6bc5a0584616b220aexe.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\EMBARGO SALARIAL_MURILLO UMAÑA ANTONIO ROSARIO.pdf"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cb24cb648e0a53c087946af276244f08

SHA1
666b5b7ceb1f37c9156bda2886c6447698b77400

SHA256
d86440cca2474e5f519ddf74a03be8dd0be5a546672cbd23d0ce1588659176f9

SHA512
64d0a490f23018c8e754dcbdd4262259a8d5db89cb157b434911f050723b25929ec37a58355160420a22c0840323399f3cbc5da3058bdd9d232052fac741e095

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\EMBARGO SALARIAL_MURILLO UMAÑA ANTONIO ROSARIO.pdf

Filesize
120KB

MD5
5fcdd51c3cd1d44b10275bec6e299ab5

SHA1
23f6b41f34950a0d6776b3b593c57474c7440797

SHA256
abcd38761579196d1f5fd4efa7c5eebc1f1e32c031775cb5539acef2dfc24bf5

SHA512
52c3bc80621716adbd9126d8ab284053bc298ab9c425ba455509851d32ae644eefb0856a33846eebe084d64d37495b479b21e7c26188aab4ed71f0b3a2ab50d6

Download Submit
memory/2932-0-0x0000000000E20000-0x0000000000F22000-memory.dmp

Filesize
1.0MB

Download
memory/2932-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2932-2-0x0000000004E80000-0x0000000004EC0000-memory.dmp

Filesize
256KB

Download
memory/2932-3-0x0000000000A50000-0x0000000000A68000-memory.dmp

Filesize
96KB

Download
memory/2932-4-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/2932-5-0x0000000000710000-0x000000000071A000-memory.dmp

Filesize
40KB

Download
memory/2932-6-0x00000000051A0000-0x0000000005246000-memory.dmp

Filesize
664KB

Download
memory/2932-20-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-13-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3068-19-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3068-11-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3068-17-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3068-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-22-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3068-23-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-24-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download
memory/3068-9-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3068-27-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-7-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/3068-43-0x0000000004BF0000-0x0000000004C30000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads