agenttesla | a1c015cd5b54daaa34d28df0ed8bb0ed2743994c3b3449a2cebc52f829c2b6d6

General

Target

ZIM Third PartyPlace ents.exe
Size

883KB
MD5

db1f3dcaf38e21694f56bbe0bda7f65d
SHA1

da91c43d51e1a2f70cd5211a88de5ed7e38efbb7
SHA256

2992b737cc487bae341eee8c6b11377b5baaace7ee2904ba6e4c91c542f1a515
SHA512

d100b8b4b87f83f64bcfeda23e0fa077be8476ee9ec8d941332939f5824eae70fc76d037b22f3018168c185dc472f82a3ecdd906e38a62b13e451ddec6154db1
SSDEEP

24576:W/Le7eGlPG3CfUWrcKh1bnTysQnjTItqb1q:Wa7eGRfdNhKAtn

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
Kene123456789
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

ZIM Third PartyPlace ents.exe

description pid process target process

PID 2424 set thread context of 2464 2424 ZIM Third PartyPlace ents.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2684 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2240 powershell.exe
2576 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2240 powershell.exe
Token: SeDebugPrivilege 2576 powershell.exe

description	pid	process	target process
PID 2424 set thread context of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe

pid	process
2684	schtasks.exe

pid	process
2240	powershell.exe
2576	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

ZIM Third PartyPlace ents.exe

description	pid	process	target process
PID 2424 wrote to memory of 2240	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2240	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2240	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2240	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2576	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2576	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2576	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2576	2424	ZIM Third PartyPlace ents.exe	powershell.exe
PID 2424 wrote to memory of 2684	2424	ZIM Third PartyPlace ents.exe	schtasks.exe
PID 2424 wrote to memory of 2684	2424	ZIM Third PartyPlace ents.exe	schtasks.exe
PID 2424 wrote to memory of 2684	2424	ZIM Third PartyPlace ents.exe	schtasks.exe
PID 2424 wrote to memory of 2684	2424	ZIM Third PartyPlace ents.exe	schtasks.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe
PID 2424 wrote to memory of 2464	2424	ZIM Third PartyPlace ents.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\ZIM Third PartyPlace ents.exe
"C:\Users\Admin\AppData\Local\Temp\ZIM Third PartyPlace ents.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ZIM Third PartyPlace ents.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TKuEOTfesQN.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TKuEOTfesQN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp730E.tmp"
2⤵
- Creates scheduled task(s)
PID:2684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp730E.tmp

Filesize
1KB

MD5
bfeb054a608d5ac614e8a889e37bcbd5

SHA1
93cacc32676f97ee2bb342d658c2a2c367968fa8

SHA256
533dab18eb4e9f4124d6bf27e8c78b01627d962f61f980bd7c13f8a0bee873ce

SHA512
09b4bc59c511e7abbbb2e2090c86f32f9027e8406e048270d1ba8a63ac24215d55052aaf44cb3da045d161096ec4d8cd41f82691f16c87d3875ba78fa90437f6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IEWZD2A77BI9YP69A8VY.temp

Filesize
7KB

MD5
00be11593283815d168af1fb24b5e957

SHA1
04ed9ce3e8de3c3b5c9eb113a15447aae80e9d79

SHA256
b9ea4f219d5f67245499bf71b2f1f82ce45fbf4e03a3a35db0f5f5d73d234a10

SHA512
693a501f7e0a1f69ae518e9a2eb0c921d0ac765e196ddda8088f49ce887b01b1383911d1b8ea49f8d80f16ea1f3eb32ca87ce3cb37a49c4458b4271c501f1fc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
00be11593283815d168af1fb24b5e957

SHA1
04ed9ce3e8de3c3b5c9eb113a15447aae80e9d79

SHA256
b9ea4f219d5f67245499bf71b2f1f82ce45fbf4e03a3a35db0f5f5d73d234a10

SHA512
693a501f7e0a1f69ae518e9a2eb0c921d0ac765e196ddda8088f49ce887b01b1383911d1b8ea49f8d80f16ea1f3eb32ca87ce3cb37a49c4458b4271c501f1fc4

Download Submit
memory/2240-24-0x0000000002C60000-0x0000000002CA0000-memory.dmp

Filesize
256KB

Download
memory/2240-39-0x000000006F380000-0x000000006F92B000-memory.dmp

Filesize
5.7MB

Download
memory/2240-21-0x000000006F380000-0x000000006F92B000-memory.dmp

Filesize
5.7MB

Download
memory/2240-28-0x000000006F380000-0x000000006F92B000-memory.dmp

Filesize
5.7MB

Download
memory/2424-4-0x00000000007A0000-0x00000000007A8000-memory.dmp

Filesize
32KB

Download
memory/2424-8-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2424-7-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-6-0x0000000007FB0000-0x000000000802A000-memory.dmp

Filesize
488KB

Download
memory/2424-5-0x0000000000A70000-0x0000000000A7A000-memory.dmp

Filesize
40KB

Download
memory/2424-3-0x0000000000D60000-0x0000000000D7A000-memory.dmp

Filesize
104KB

Download
memory/2424-2-0x0000000004DF0000-0x0000000004E30000-memory.dmp

Filesize
256KB

Download
memory/2424-37-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2424-0-0x0000000000D80000-0x0000000000E62000-memory.dmp

Filesize
904KB

Download
memory/2424-1-0x0000000074830000-0x0000000074F1E000-memory.dmp

Filesize
6.9MB

Download
memory/2464-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2464-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2464-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2576-25-0x000000006F380000-0x000000006F92B000-memory.dmp

Filesize
5.7MB

Download
memory/2576-23-0x0000000001EF0000-0x0000000001F30000-memory.dmp

Filesize
256KB

Download
memory/2576-38-0x000000006F380000-0x000000006F92B000-memory.dmp

Filesize
5.7MB

Download
memory/2576-22-0x000000006F380000-0x000000006F92B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads