agenttesla | 03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259

General

Target

03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
Size

859KB
MD5

e9e5c3ff2c288652632693cfd0430ed8
SHA1

f60a44bf7b3742211f2beda69263fd2d03ddfe30
SHA256

03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259
SHA512

95564ff00eb160d6302428bc6b8327a657fc1fe29221dbfad692c19f65a14effbefaf9653c57a19b3ffffd07b07e64e5f09b099100811c10599fdc0f21c25f48
SSDEEP

24576:FmBLPgdVRTuGQlYPHsKyRlPTGgRvddgw:FeUvRTFQezgRv/

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6637410244:AAGgZSHwlIIsLzowq8HIZ_Iwmc3l0ETb130/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

description	pid	process	target process
PID 884 set thread context of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2884 schtasks.exe

pid	process
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exepowershell.exepowershell.exe03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

pid	process
884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
2744	powershell.exe
2644	powershell.exe
2552	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
2552	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exepowershell.exepowershell.exe03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

description	pid	process
Token: SeDebugPrivilege	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	2552	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

pid process

2552 03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

pid	process
2552	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

description	pid	process	target process
PID 884 wrote to memory of 2744	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2744	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2744	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2744	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2644	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2644	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2644	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2644	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	powershell.exe
PID 884 wrote to memory of 2884	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	schtasks.exe
PID 884 wrote to memory of 2884	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	schtasks.exe
PID 884 wrote to memory of 2884	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	schtasks.exe
PID 884 wrote to memory of 2884	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	schtasks.exe
PID 884 wrote to memory of 2668	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2668	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2668	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2668	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
PID 884 wrote to memory of 2552	884	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe	03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe

C:\Users\Admin\AppData\Local\Temp\03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
"C:\Users\Admin\AppData\Local\Temp\03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VvKFwCGN.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VvKFwCGN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD76B.tmp"
2⤵
- Creates scheduled task(s)
PID:2884

C:\Users\Admin\AppData\Local\Temp\03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
"C:\Users\Admin\AppData\Local\Temp\03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe"
2⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe
"C:\Users\Admin\AppData\Local\Temp\03aa19425c8129368ed652eb0de192dea72829c6644ab74e23e0c8a28702b259.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD76B.tmp

Filesize
1KB

MD5
9c4bcc507810f27359b20d187135ff76

SHA1
9967a8d6a2e48c28f5f8cae8cb4bcaca06446f05

SHA256
f25bf070bfc12142749278623417a829640a83ed110ce62329b26ab58253a1b5

SHA512
da5453380948d1e64fa99edc5cd15be467931525744284bec4ca8782224316dd4a9ddfbd585765c7176cd6cc415d52d13713ff67ed4c088a5e45b976ecb04e63

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5OKPGOVWV0WQ9O22YNJ6.temp

Filesize
7KB

MD5
c44142b891d681bc610dadd59d92c56d

SHA1
60a8d88c347ed30c1d220ecf499dffa4f61fa8f0

SHA256
92209df650581a131de8bc3aeb74c488ca53a5d0812cba6170d1ff857edac2c3

SHA512
b34c3768a99d439ab1bbe0b6f6276125fb143dfc913f9e5a463a4d966f93e9b681abf79c5a7be1b99a0f46c01eb0737e596eec29b6389793f9add297506fb91c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c44142b891d681bc610dadd59d92c56d

SHA1
60a8d88c347ed30c1d220ecf499dffa4f61fa8f0

SHA256
92209df650581a131de8bc3aeb74c488ca53a5d0812cba6170d1ff857edac2c3

SHA512
b34c3768a99d439ab1bbe0b6f6276125fb143dfc913f9e5a463a4d966f93e9b681abf79c5a7be1b99a0f46c01eb0737e596eec29b6389793f9add297506fb91c

Download Submit
memory/884-31-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/884-0-0x0000000000B70000-0x0000000000C4E000-memory.dmp

Filesize
888KB

Download
memory/884-4-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/884-6-0x0000000005BF0000-0x0000000005C7E000-memory.dmp

Filesize
568KB

Download
memory/884-3-0x0000000000580000-0x0000000000598000-memory.dmp

Filesize
96KB

Download
memory/884-2-0x0000000002170000-0x00000000021B0000-memory.dmp

Filesize
256KB

Download
memory/884-1-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/884-5-0x0000000000B00000-0x0000000000B0A000-memory.dmp

Filesize
40KB

Download
memory/2552-49-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Filesize
256KB

Download
memory/2552-43-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-25-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-29-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-21-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-19-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-48-0x0000000073330000-0x0000000073A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2552-45-0x0000000004EA0000-0x0000000004EE0000-memory.dmp

Filesize
256KB

Download
memory/2552-44-0x0000000073330000-0x0000000073A1E000-memory.dmp

Filesize
6.9MB

Download
memory/2552-23-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2552-41-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2644-38-0x0000000002230000-0x0000000002270000-memory.dmp

Filesize
256KB

Download
memory/2644-36-0x0000000002230000-0x0000000002270000-memory.dmp

Filesize
256KB

Download
memory/2644-40-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-39-0x0000000002230000-0x0000000002270000-memory.dmp

Filesize
256KB

Download
memory/2644-46-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/2644-33-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-37-0x0000000002480000-0x00000000024C0000-memory.dmp

Filesize
256KB

Download
memory/2744-35-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-32-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-47-0x000000006E760000-0x000000006ED0B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-34-0x0000000002480000-0x00000000024C0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads