agenttesla | 70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817

General

Target

70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe
Size

192KB
MD5

c83e8d01fa4bb2a29de8757bab77c261
SHA1

fd996e799182968527ae6bbae5949f6970e41940
SHA256

70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817
SHA512

be57ca047c5d909c7d792ef4c21936988da5f5a0667f7c5d89cdfa31f34579fd3dafb04f0a0d4054b7202cfdc4a8671157e31749c20276d0e40896f9b135186a
SSDEEP

3072:vgjT7lyimAFECy61CVJ1o+AeBImCytphGqsdo6pBA:vgH7lyim7CED5AeOdyqdo6p

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6815919082:AAHg0w-xxR8W47F1m3szCzCr2P1b4AttF-E/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mail = "C:\\Users\\Admin\\documents\\mail.exe"	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3584	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe
3584	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe
Token: SeDebugPrivilege	3584	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90
PID 2796 wrote to memory of 3584	2796	70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe	90

C:\Users\Admin\AppData\Local\Temp\70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe
"C:\Users\Admin\AppData\Local\Temp\70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe
  C:\Users\Admin\AppData\Local\Temp\70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\70599fe914edfb27f40868d4cab51383791548e119d48ea1cf2748362a623817.exe.log

Filesize
1KB

MD5
8c2da65103d6b46d8cf610b118210cf0

SHA1
9db4638340bb74f2af3161cc2c9c0b8b32e6ab65

SHA256
0e48e2efd419951e0eb9a8d942493cfdf5540d1d19ff9dae6f145fb3ebcbeeac

SHA512
3cf5a125276e264cd8478f2b92d3848fb68b96d46eb4a39e650d09df02068c274881a1c314cdfbfdcb452672fb70dd8becf3ffe9562d39919d9c4d6b07fbb614

Download Submit
memory/2796-8-0x0000000006F80000-0x0000000006FC0000-memory.dmp

Filesize
256KB

Download
memory/2796-3-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/2796-9-0x0000000006FC0000-0x000000000700C000-memory.dmp

Filesize
304KB

Download
memory/2796-1-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/2796-5-0x0000000005890000-0x000000000589A000-memory.dmp

Filesize
40KB

Download
memory/2796-6-0x0000000006D70000-0x0000000006DCA000-memory.dmp

Filesize
360KB

Download
memory/2796-7-0x0000000006E40000-0x0000000006E82000-memory.dmp

Filesize
264KB

Download
memory/2796-0-0x0000000000DC0000-0x0000000000DF4000-memory.dmp

Filesize
208KB

Download
memory/2796-14-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/2796-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/2796-4-0x0000000005970000-0x0000000005980000-memory.dmp

Filesize
64KB

Download
memory/3584-20-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/3584-15-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/3584-17-0x0000000004E90000-0x0000000004EF6000-memory.dmp

Filesize
408KB

Download
memory/3584-16-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/3584-18-0x0000000006320000-0x00000000063BC000-memory.dmp

Filesize
624KB

Download
memory/3584-19-0x0000000074E30000-0x00000000755E0000-memory.dmp

Filesize
7.7MB

Download
memory/3584-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads