agenttesla | fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076

General

Target

fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
Size

642KB
MD5

8f6e32020ff43045b2167852d84e54a3
SHA1

7b58b87ffdf0ff255451a178204934a2eb2e215c
SHA256

fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076
SHA512

a029dc4ba9039bac202616b1b1e2772bcbed35c499a022f6a5f038676df56913a03d92401c4c26b495f56bf2d38f513b0c7c1e32b0a39237edf4cf618082ba66
SSDEEP

12288:t45+po2KVqLle12KbhMsXj/aVZbKCLMya+VRB4SmL2EoSbpXNvLVslIqh:Y+pJKaQ12sMsXIBLpRIL3dFVslI

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
zqamcx.com
Port:
587
Username:
[email protected]
Password:
Anambraeast@2023
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe

description	pid	process	target process
PID 2068 set thread context of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2996 schtasks.exe

pid	process
2996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exefda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exepowershell.exepowershell.exe

pid	process
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2636	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2636	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
2892	powershell.exe
2720	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exefda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
Token: SeDebugPrivilege	2636	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe

pid process

2636 fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe

pid	process
2636	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe

description	pid	process	target process
PID 2068 wrote to memory of 2720	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2720	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2720	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2720	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2892	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2892	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2892	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2892	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	powershell.exe
PID 2068 wrote to memory of 2996	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	schtasks.exe
PID 2068 wrote to memory of 2996	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	schtasks.exe
PID 2068 wrote to memory of 2996	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	schtasks.exe
PID 2068 wrote to memory of 2996	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	schtasks.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
PID 2068 wrote to memory of 2636	2068	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe	fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe

C:\Users\Admin\AppData\Local\Temp\fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
"C:\Users\Admin\AppData\Local\Temp\fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hHSNKkRCjf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hHSNKkRCjf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F6B.tmp"
2⤵
- Creates scheduled task(s)
PID:2996

C:\Users\Admin\AppData\Local\Temp\fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe
"C:\Users\Admin\AppData\Local\Temp\fda6a19a5be3d7cdb1c894afa2b2b47bf7ce53c4ed27ba6d50035fe07046f076exe.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9F6B.tmp

Filesize
1KB

MD5
06816f6fd2fef398cdedf1f3e411db83

SHA1
b34661b60f47d17dd8d053f7c3b8a03f4e908973

SHA256
801cd1cbaf8c6abe38fa4d746195faa42d5bfe853cb14b466631e77cc39d0d53

SHA512
5e8f1cc1315c2468f663f4242474eeebb4857cb23c78f089e4d32fab9f1e0e2626d6857df8979eb759a15ad0bb5fe1379eff24e7d6ff15b864533deb3461ae25

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5QGN893AHP2EL2T9O55K.temp

Filesize
7KB

MD5
899fb2065f108ccde60f9e6e88109755

SHA1
dec5a6ab762b5909d2d87cb6707f53647198a5e6

SHA256
ace76d8ed991aa2c0c9600df75d799fb5f47731d040d53313c4e589f1e4c0d12

SHA512
3e8e91e1f715482cbae2d7d4f7f86d6a2f2e7bb50295a7e623057dd48da75484a5827c7263c3bb9c144637760f3f678ab1cd6b5adb573cf39fb078566358b9ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
899fb2065f108ccde60f9e6e88109755

SHA1
dec5a6ab762b5909d2d87cb6707f53647198a5e6

SHA256
ace76d8ed991aa2c0c9600df75d799fb5f47731d040d53313c4e589f1e4c0d12

SHA512
3e8e91e1f715482cbae2d7d4f7f86d6a2f2e7bb50295a7e623057dd48da75484a5827c7263c3bb9c144637760f3f678ab1cd6b5adb573cf39fb078566358b9ce

Download Submit
memory/2068-3-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/2068-4-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/2068-5-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/2068-6-0x0000000005C30000-0x0000000005CAC000-memory.dmp

Filesize
496KB

Download
memory/2068-7-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2068-8-0x0000000000B50000-0x0000000000B90000-memory.dmp

Filesize
256KB

Download
memory/2068-1-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2068-2-0x0000000000B50000-0x0000000000B90000-memory.dmp

Filesize
256KB

Download
memory/2068-0-0x0000000000DD0000-0x0000000000E76000-memory.dmp

Filesize
664KB

Download
memory/2068-34-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2636-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2636-40-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2636-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-48-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/2636-47-0x0000000074B00000-0x00000000751EE000-memory.dmp

Filesize
6.9MB

Download
memory/2636-41-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/2636-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-38-0x000000006D0C0000-0x000000006D66B000-memory.dmp

Filesize
5.7MB

Download
memory/2720-42-0x0000000002C00000-0x0000000002C40000-memory.dmp

Filesize
256KB

Download
memory/2720-44-0x0000000002C00000-0x0000000002C40000-memory.dmp

Filesize
256KB

Download
memory/2720-45-0x000000006D0C0000-0x000000006D66B000-memory.dmp

Filesize
5.7MB

Download
memory/2720-36-0x000000006D0C0000-0x000000006D66B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-39-0x000000006D0C0000-0x000000006D66B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-37-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/2892-43-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/2892-46-0x000000006D0C0000-0x000000006D66B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-35-0x000000006D0C0000-0x000000006D66B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads