agenttesla | f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b

General

Target

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
Size

8.0MB
MD5

3415d0d8eb2143284827fe443a317dc1
SHA1

ae927f104a4755cf28204e1818a7f7cdca484485
SHA256

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b
SHA512

cde4cb9981d8bb2114821aa0f66a2b5db472730067c7a40ed4b3f8cb7c733eb8bd37ae413ad74670bf76ce31e498fb4af83cd60fc50ccec2dd49a0f39796ad83
SSDEEP

98304:AddhXpr5FO4qPdudczq7a/e1QCyTxvDWHQg2RMYKqUrNqEK:AdXXpr5FO4qVudrIxvCj2RfKqUrNqT

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.marinasands.gr
Port:
587
Username:
[email protected]
Password:
2WKm}0K~,RiV
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

2540 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2968 cmd.exe

pid	process
2540	svchost.exe

pid	process
2968	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 2540 set thread context of 2984 2540 svchost.exe CasPol.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2992 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2652 timeout.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 2540 set thread context of 2984	2540	svchost.exe	CasPol.exe

pid	process
2992	schtasks.exe

pid	process
2652	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exeCasPol.exe

pid	process
2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
2984	CasPol.exe
2984	CasPol.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exesvchost.exeCasPol.exe

description	pid	process
Token: SeDebugPrivilege	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
Token: SeDebugPrivilege	2540	svchost.exe
Token: SeDebugPrivilege	2984	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CasPol.exe

pid process

2984 CasPol.exe

pid	process
2984	CasPol.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.execmd.execmd.exesvchost.exe

description	pid	process	target process
PID 2952 wrote to memory of 2088	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2952 wrote to memory of 2088	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2952 wrote to memory of 2088	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2952 wrote to memory of 2088	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2952 wrote to memory of 2968	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2952 wrote to memory of 2968	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2952 wrote to memory of 2968	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2952 wrote to memory of 2968	2952	f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe	cmd.exe
PID 2088 wrote to memory of 2992	2088	cmd.exe	schtasks.exe
PID 2088 wrote to memory of 2992	2088	cmd.exe	schtasks.exe
PID 2088 wrote to memory of 2992	2088	cmd.exe	schtasks.exe
PID 2088 wrote to memory of 2992	2088	cmd.exe	schtasks.exe
PID 2968 wrote to memory of 2652	2968	cmd.exe	timeout.exe
PID 2968 wrote to memory of 2652	2968	cmd.exe	timeout.exe
PID 2968 wrote to memory of 2652	2968	cmd.exe	timeout.exe
PID 2968 wrote to memory of 2652	2968	cmd.exe	timeout.exe
PID 2968 wrote to memory of 2540	2968	cmd.exe	svchost.exe
PID 2968 wrote to memory of 2540	2968	cmd.exe	svchost.exe
PID 2968 wrote to memory of 2540	2968	cmd.exe	svchost.exe
PID 2968 wrote to memory of 2540	2968	cmd.exe	svchost.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe
PID 2540 wrote to memory of 2984	2540	svchost.exe	CasPol.exe

C:\Users\Admin\AppData\Local\Temp\f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe
"C:\Users\Admin\AppData\Local\Temp\f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2088

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
3⤵
- Creates scheduled task(s)
PID:2992

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpAB0E.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\SysWOW64\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:2652

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAB0E.tmp.bat

Filesize
151B

MD5
e00852b8abe73c7a26b5c8e6647b9303

SHA1
5c40b59afbb8773e32f7bbb2586f0ca2eeda9544

SHA256
9d9d691a18ca8d5cd148cda9e56eac966489b557319b2405c0163ef33bd72aa5

SHA512
380b1fbcec4dcd2a8331052655c292fb9de61dd4f2d650519d185801e9d2e5a290d0f67f8a75a7f2183d7d8291073a50e85f435d045a7dbb084a3e0e4ddfaf44

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAB0E.tmp.bat

Filesize
151B

MD5
e00852b8abe73c7a26b5c8e6647b9303

SHA1
5c40b59afbb8773e32f7bbb2586f0ca2eeda9544

SHA256
9d9d691a18ca8d5cd148cda9e56eac966489b557319b2405c0163ef33bd72aa5

SHA512
380b1fbcec4dcd2a8331052655c292fb9de61dd4f2d650519d185801e9d2e5a290d0f67f8a75a7f2183d7d8291073a50e85f435d045a7dbb084a3e0e4ddfaf44

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
8.0MB

MD5
3415d0d8eb2143284827fe443a317dc1

SHA1
ae927f104a4755cf28204e1818a7f7cdca484485

SHA256
f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b

SHA512
cde4cb9981d8bb2114821aa0f66a2b5db472730067c7a40ed4b3f8cb7c733eb8bd37ae413ad74670bf76ce31e498fb4af83cd60fc50ccec2dd49a0f39796ad83

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
8.0MB

MD5
3415d0d8eb2143284827fe443a317dc1

SHA1
ae927f104a4755cf28204e1818a7f7cdca484485

SHA256
f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b

SHA512
cde4cb9981d8bb2114821aa0f66a2b5db472730067c7a40ed4b3f8cb7c733eb8bd37ae413ad74670bf76ce31e498fb4af83cd60fc50ccec2dd49a0f39796ad83

Download Submit
\Users\Admin\AppData\Roaming\svchost.exe

Filesize
8.0MB

MD5
3415d0d8eb2143284827fe443a317dc1

SHA1
ae927f104a4755cf28204e1818a7f7cdca484485

SHA256
f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b

SHA512
cde4cb9981d8bb2114821aa0f66a2b5db472730067c7a40ed4b3f8cb7c733eb8bd37ae413ad74670bf76ce31e498fb4af83cd60fc50ccec2dd49a0f39796ad83

Download Submit
memory/2540-20-0x00000000052B0000-0x00000000052F0000-memory.dmp

Filesize
256KB

Download
memory/2540-19-0x0000000000FB0000-0x00000000017B8000-memory.dmp

Filesize
8.0MB

Download
memory/2540-25-0x0000000073E40000-0x000000007452E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-21-0x0000000000800000-0x000000000081A000-memory.dmp

Filesize
104KB

Download
memory/2540-18-0x0000000073E40000-0x000000007452E000-memory.dmp

Filesize
6.9MB

Download
memory/2952-0-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download
memory/2952-1-0x0000000000890000-0x0000000001098000-memory.dmp

Filesize
8.0MB

Download
memory/2952-4-0x0000000000850000-0x000000000086A000-memory.dmp

Filesize
104KB

Download
memory/2952-3-0x0000000000780000-0x0000000000814000-memory.dmp

Filesize
592KB

Download
memory/2952-2-0x0000000005110000-0x0000000005150000-memory.dmp

Filesize
256KB

Download
memory/2952-14-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2984-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2984-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2984-28-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-29-0x0000000004940000-0x0000000004980000-memory.dmp

Filesize
256KB

Download
memory/2984-30-0x0000000074530000-0x0000000074C1E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-31-0x0000000004940000-0x0000000004980000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads