agenttesla | 2992b737cc487bae341eee8c6b11377b5baaace7ee2904ba6e4c91c542f1a515

General

Target

SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe
Size

883KB
MD5

db1f3dcaf38e21694f56bbe0bda7f65d
SHA1

da91c43d51e1a2f70cd5211a88de5ed7e38efbb7
SHA256

2992b737cc487bae341eee8c6b11377b5baaace7ee2904ba6e4c91c542f1a515
SHA512

d100b8b4b87f83f64bcfeda23e0fa077be8476ee9ec8d941332939f5824eae70fc76d037b22f3018168c185dc472f82a3ecdd906e38a62b13e451ddec6154db1
SSDEEP

24576:W/Le7eGlPG3CfUWrcKh1bnTysQnjTItqb1q:Wa7eGRfdNhKAtn

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
Kene123456789
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe

description pid process target process

PID 1740 set thread context of 2772 1740 SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2712 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RegSvcs.exepowershell.exepowershell.exe

pid process

2772 RegSvcs.exe
2772 RegSvcs.exe
2696 powershell.exe
2020 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RegSvcs.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2772 RegSvcs.exe
Token: SeDebugPrivilege 2696 powershell.exe
Token: SeDebugPrivilege 2020 powershell.exe

description	pid	process	target process
PID 1740 set thread context of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe

pid	process
2712	schtasks.exe

pid	process
2772	RegSvcs.exe
2772	RegSvcs.exe
2696	powershell.exe
2020	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2772	RegSvcs.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe

description	pid	process	target process
PID 1740 wrote to memory of 2696	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2696	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2696	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2696	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2020	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2020	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2020	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2020	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	powershell.exe
PID 1740 wrote to memory of 2712	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	schtasks.exe
PID 1740 wrote to memory of 2712	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	schtasks.exe
PID 1740 wrote to memory of 2712	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	schtasks.exe
PID 1740 wrote to memory of 2712	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	schtasks.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe
PID 1740 wrote to memory of 2772	1740	SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDropNET.68.32742.9574.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TKuEOTfesQN.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TKuEOTfesQN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF69.tmp"
2⤵
- Creates scheduled task(s)
PID:2712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBF69.tmp

Filesize
1KB

MD5
0493daa4d0e493adb6a6d0f49f178e7e

SHA1
7649c1e17e7dd8c29a5ed2096aab911f8468a58b

SHA256
41cafdd1f5d72fc9292331bb6ba7805a458950a2f27e475875b1a1735a61ad42

SHA512
bb359f2aef13d7375254eb6faa134bb6d06954419a47edbbbb90f159cb3d0188f2fa0a4a98d43adf9e0f1400bf32eef7ba09bf93ed471cdd52d2ad0f27536ae0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\33YL0EEL14T4AT2738PW.temp

Filesize
7KB

MD5
59e807aef908af9825bcd36567f0a005

SHA1
d5e4e76d74436fb7d1586cf2350eb8e183b35296

SHA256
5d07a5bf11dfb295a7e71ca045bb5c1f139916824f6f1d0633daf358e9ff5c0b

SHA512
3b308ceb4215b0d3705476fc8a0e6cb7659278aa9074bebacc3e7cf48ff888866457a13e98ab1f9076d0631b0e0dba16eb8f656e1da36bca11564eee3ccb4edc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
59e807aef908af9825bcd36567f0a005

SHA1
d5e4e76d74436fb7d1586cf2350eb8e183b35296

SHA256
5d07a5bf11dfb295a7e71ca045bb5c1f139916824f6f1d0633daf358e9ff5c0b

SHA512
3b308ceb4215b0d3705476fc8a0e6cb7659278aa9074bebacc3e7cf48ff888866457a13e98ab1f9076d0631b0e0dba16eb8f656e1da36bca11564eee3ccb4edc

Download Submit
memory/1740-3-0x00000000004F0000-0x000000000050A000-memory.dmp

Filesize
104KB

Download
memory/1740-4-0x0000000000730000-0x0000000000738000-memory.dmp

Filesize
32KB

Download
memory/1740-5-0x0000000000740000-0x000000000074A000-memory.dmp

Filesize
40KB

Download
memory/1740-6-0x0000000005F70000-0x0000000005FEA000-memory.dmp

Filesize
488KB

Download
memory/1740-7-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-8-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1740-1-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-2-0x0000000004F40000-0x0000000004F80000-memory.dmp

Filesize
256KB

Download
memory/1740-0-0x0000000000AF0000-0x0000000000BD2000-memory.dmp

Filesize
904KB

Download
memory/1740-39-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/2020-25-0x000000006E500000-0x000000006EAAB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-42-0x0000000002570000-0x00000000025B0000-memory.dmp

Filesize
256KB

Download
memory/2020-44-0x000000006E500000-0x000000006EAAB000-memory.dmp

Filesize
5.7MB

Download
memory/2020-34-0x0000000002570000-0x00000000025B0000-memory.dmp

Filesize
256KB

Download
memory/2696-45-0x000000006E500000-0x000000006EAAB000-memory.dmp

Filesize
5.7MB

Download
memory/2696-27-0x0000000002700000-0x0000000002740000-memory.dmp

Filesize
256KB

Download
memory/2696-43-0x0000000002700000-0x0000000002740000-memory.dmp

Filesize
256KB

Download
memory/2696-22-0x000000006E500000-0x000000006EAAB000-memory.dmp

Filesize
5.7MB

Download
memory/2696-30-0x000000006E500000-0x000000006EAAB000-memory.dmp

Filesize
5.7MB

Download
memory/2696-32-0x0000000002700000-0x0000000002740000-memory.dmp

Filesize
256KB

Download
memory/2772-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2772-38-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-40-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/2772-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-36-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-41-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download
memory/2772-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2772-46-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/2772-47-0x00000000048C0000-0x0000000004900000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads