agenttesla | 394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35

General

Target

394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
Size

832KB
MD5

4cc3e6a5b1f5473111ed0fe08c85455b
SHA1

5c13bab0cff294b13c0542fca040c19ec94e2967
SHA256

394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35
SHA512

58ec9c7407439d5143a2614add8bd79063be03cc94539628ceb7290b362c1ff0e9a2884cae59700151a60d1b55db1ca3da4e395196137b89af443ceed19963c5
SSDEEP

12288:ac5nF8ME6jD/yecHhUHkWlijOnpmz32LP7PP0WKLcuCgRNwgqYqRe:acPtD/yeGXWliGmzGLjZdgRSgqg

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
zqamcx.com
Port:
587
Username:
[email protected]
Password:
Methodman991
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe

description	pid	process	target process
PID 2380 set thread context of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2804 schtasks.exe

pid	process
2804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exepowershell.exepowershell.exe

pid	process
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2632	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2632	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
2688	powershell.exe
2724	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
Token: SeDebugPrivilege	2632	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe

pid process

2632 394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe

pid	process
2632	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe

description	pid	process	target process
PID 2380 wrote to memory of 2688	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2688	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2688	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2688	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2724	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2724	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2724	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2724	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	powershell.exe
PID 2380 wrote to memory of 2804	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	schtasks.exe
PID 2380 wrote to memory of 2804	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	schtasks.exe
PID 2380 wrote to memory of 2804	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	schtasks.exe
PID 2380 wrote to memory of 2804	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	schtasks.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
PID 2380 wrote to memory of 2632	2380	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe	394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe

C:\Users\Admin\AppData\Local\Temp\394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
"C:\Users\Admin\AppData\Local\Temp\394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ocsLtLXucVcFxs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ocsLtLXucVcFxs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5DE.tmp"
2⤵
- Creates scheduled task(s)
PID:2804

C:\Users\Admin\AppData\Local\Temp\394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe
"C:\Users\Admin\AppData\Local\Temp\394633bc848d312c2e79e48b1b10eadbce297624c6b844d4f643d93b1fb33c35.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC5DE.tmp

Filesize
1KB

MD5
2db713f74ce6cd754ec19261175cb84d

SHA1
a9301d3da1643fe479dbdb9c176346ad6e106b5a

SHA256
63dc29e03bee522df2e2fe44f2c9028ad1bd0e8ac0f7ebbdf26c394c2f3c11f6

SHA512
ffd5e76df2a5aa858549ed3335c5e65266ff4419902dfd160d178aebf7f0ed4aaf667b14cd60a8edc3ba8901404758615cc3524ce15a9a9cfc14171c62a7d282

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B0LI36PFMBDP75IYODK7.temp

Filesize
7KB

MD5
f4ede9cabfe2cf64445ead1c063dfa87

SHA1
bb671cbef7836e11c547df79fbdeefcd0e236c1e

SHA256
054b2042b68ca6d81ca5d46c78c060c578d03b4af800ba62fa94a182a2a01eaa

SHA512
88fbdb129faaf71d3d982b6d3b6d2068f90ed0c3fd1d8d073b5a2d70d93ddc88bc14766dafa5312b8d76944a032d0e50c4556e04943aa840bf3f993fdc84e684

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f4ede9cabfe2cf64445ead1c063dfa87

SHA1
bb671cbef7836e11c547df79fbdeefcd0e236c1e

SHA256
054b2042b68ca6d81ca5d46c78c060c578d03b4af800ba62fa94a182a2a01eaa

SHA512
88fbdb129faaf71d3d982b6d3b6d2068f90ed0c3fd1d8d073b5a2d70d93ddc88bc14766dafa5312b8d76944a032d0e50c4556e04943aa840bf3f993fdc84e684

Download Submit
memory/2380-3-0x0000000000360000-0x0000000000378000-memory.dmp

Filesize
96KB

Download
memory/2380-4-0x0000000000560000-0x0000000000568000-memory.dmp

Filesize
32KB

Download
memory/2380-5-0x00000000005C0000-0x00000000005CA000-memory.dmp

Filesize
40KB

Download
memory/2380-6-0x0000000005CC0000-0x0000000005D3C000-memory.dmp

Filesize
496KB

Download
memory/2380-7-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-8-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/2380-0-0x0000000000260000-0x0000000000334000-memory.dmp

Filesize
848KB

Download
memory/2380-2-0x0000000004BA0000-0x0000000004BE0000-memory.dmp

Filesize
256KB

Download
memory/2380-1-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2380-32-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2632-40-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2632-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2632-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2632-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2632-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2632-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2632-45-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2632-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2688-35-0x00000000028B0000-0x00000000028F0000-memory.dmp

Filesize
256KB

Download
memory/2688-37-0x000000006EFD0000-0x000000006F57B000-memory.dmp

Filesize
5.7MB

Download
memory/2688-34-0x000000006EFD0000-0x000000006F57B000-memory.dmp

Filesize
5.7MB

Download
memory/2688-42-0x00000000028B0000-0x00000000028F0000-memory.dmp

Filesize
256KB

Download
memory/2688-44-0x000000006EFD0000-0x000000006F57B000-memory.dmp

Filesize
5.7MB

Download
memory/2724-36-0x000000006EFD0000-0x000000006F57B000-memory.dmp

Filesize
5.7MB

Download
memory/2724-38-0x00000000025F0000-0x0000000002630000-memory.dmp

Filesize
256KB

Download
memory/2724-39-0x00000000025F0000-0x0000000002630000-memory.dmp

Filesize
256KB

Download
memory/2724-41-0x00000000025F0000-0x0000000002630000-memory.dmp

Filesize
256KB

Download
memory/2724-43-0x000000006EFD0000-0x000000006F57B000-memory.dmp

Filesize
5.7MB

Download
memory/2724-33-0x000000006EFD0000-0x000000006F57B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads