agenttesla | ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac

General

Target

ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
Size

820KB
MD5

e1eb6a93f5b33ba65a052a6de047af05
SHA1

46b112ed5b75224f44707967ccebf15e99845be3
SHA256

ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac
SHA512

abdce0bb8ddf97e68e5d93d6e6cd5feb98658f9c2020a2677c83dd6777ba6d49d81b30f243348bdaa2f84da21636cfbfe8c54a069829b67ecfe3fea787a191bd
SSDEEP

12288:OLKE6jD/62iNG5nF8TUEo0g+OVY38KclmzNsvsuG6rxN71wQw4VvFXHUQ853:OLKtD/61I6vSGsp8Nqs81NhE45NS5

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6774056184:AAGNRsfh8TKtp3v_QDZCQW1e8ODSvVaHvMo/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe

description	pid	process	target process
PID 1708 set thread context of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2724 schtasks.exe

pid	process
2724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exepowershell.exepowershell.exe

pid	process
2404	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
2404	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
2680	powershell.exe
2868	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2404	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe

pid process

2404 ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe

description	pid	process	target process
PID 1708 wrote to memory of 2868	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2868	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2868	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2868	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2680	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2680	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2680	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2680	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	powershell.exe
PID 1708 wrote to memory of 2724	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	schtasks.exe
PID 1708 wrote to memory of 2724	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	schtasks.exe
PID 1708 wrote to memory of 2724	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	schtasks.exe
PID 1708 wrote to memory of 2724	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	schtasks.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
PID 1708 wrote to memory of 2404	1708	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe	ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe

C:\Users\Admin\AppData\Local\Temp\ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
"C:\Users\Admin\AppData\Local\Temp\ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PUZcXIafrmbImY.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PUZcXIafrmbImY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4E6E.tmp"
2⤵
- Creates scheduled task(s)
PID:2724

C:\Users\Admin\AppData\Local\Temp\ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe
"C:\Users\Admin\AppData\Local\Temp\ef1fbaf09a00979fb3c25debeebe53c2ff844f11d817d5d925c634666c5657ac.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4E6E.tmp

Filesize
1KB

MD5
eb6eb34699ed8c092b5d8de656a638b4

SHA1
08be9532c3d8853c5e74d2b4c4766033ef168b2b

SHA256
cc60bf3327fea65d3b90b5e87b2e59c6a21f28c163798e3a4669f2f77bc9bab5

SHA512
4025ba57e24b6911342a3831192179876dc1365cacdedc2e26073850d06a0dac7321569c1f49c3566c0edec14bcfb35dbba7e3017d6b405bed4acad6712a78d2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a7037c36e410e12e71eb04b5f65342a9

SHA1
81bec424608e18f955d26240ca5b25ecdd874612

SHA256
6d8d0288d92c733834908a18fd8af500015e8ab2ba87a8ae6bb3d2f9e8005d34

SHA512
d8ccee50372db674468736c6a6b61dd122cd460e28232a85688a076efa4d69f56ef6d3bb87b88db018b0e76674df8aea1ae6f15591bbe0d99693669c0074a37f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a7037c36e410e12e71eb04b5f65342a9

SHA1
81bec424608e18f955d26240ca5b25ecdd874612

SHA256
6d8d0288d92c733834908a18fd8af500015e8ab2ba87a8ae6bb3d2f9e8005d34

SHA512
d8ccee50372db674468736c6a6b61dd122cd460e28232a85688a076efa4d69f56ef6d3bb87b88db018b0e76674df8aea1ae6f15591bbe0d99693669c0074a37f

Download Submit
memory/1708-31-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-4-0x0000000004080000-0x0000000004088000-memory.dmp

Filesize
32KB

Download
memory/1708-5-0x0000000004090000-0x000000000409A000-memory.dmp

Filesize
40KB

Download
memory/1708-6-0x0000000005160000-0x00000000051DC000-memory.dmp

Filesize
496KB

Download
memory/1708-3-0x0000000004060000-0x0000000004078000-memory.dmp

Filesize
96KB

Download
memory/1708-2-0x00000000048F0000-0x0000000004930000-memory.dmp

Filesize
256KB

Download
memory/1708-1-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/1708-0-0x0000000000980000-0x0000000000A54000-memory.dmp

Filesize
848KB

Download
memory/2404-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2404-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2404-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2404-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2404-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2404-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2404-48-0x00000000007A0000-0x00000000007E0000-memory.dmp

Filesize
256KB

Download
memory/2404-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2404-42-0x00000000007A0000-0x00000000007E0000-memory.dmp

Filesize
256KB

Download
memory/2404-40-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2404-47-0x0000000074090000-0x000000007477E000-memory.dmp

Filesize
6.9MB

Download
memory/2404-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2680-38-0x0000000002E20000-0x0000000002E60000-memory.dmp

Filesize
256KB

Download
memory/2680-44-0x000000006E1D0000-0x000000006E77B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-41-0x0000000002E20000-0x0000000002E60000-memory.dmp

Filesize
256KB

Download
memory/2680-35-0x000000006E1D0000-0x000000006E77B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-45-0x000000006E1D0000-0x000000006E77B000-memory.dmp

Filesize
5.7MB

Download
memory/2868-37-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/2868-43-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/2868-46-0x000000006E1D0000-0x000000006E77B000-memory.dmp

Filesize
5.7MB

Download
memory/2868-39-0x000000006E1D0000-0x000000006E77B000-memory.dmp

Filesize
5.7MB

Download
memory/2868-36-0x000000006E1D0000-0x000000006E77B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads