agenttesla | a1c015cd5b54daaa34d28df0ed8bb0ed2743994c3b3449a2cebc52f829c2b6d6

General

Target

ZIM Third PartyPlace ents.exe
Size

883KB
MD5

db1f3dcaf38e21694f56bbe0bda7f65d
SHA1

da91c43d51e1a2f70cd5211a88de5ed7e38efbb7
SHA256

2992b737cc487bae341eee8c6b11377b5baaace7ee2904ba6e4c91c542f1a515
SHA512

d100b8b4b87f83f64bcfeda23e0fa077be8476ee9ec8d941332939f5824eae70fc76d037b22f3018168c185dc472f82a3ecdd906e38a62b13e451ddec6154db1
SSDEEP

24576:W/Le7eGlPG3CfUWrcKh1bnTysQnjTItqb1q:Wa7eGRfdNhKAtn

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.bezzleauto.com
Port:
587
Username:
[email protected]
Password:
Kene123456789
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 1692	2892	ZIM Third PartyPlace ents.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2632	powershell.exe
2948	powershell.exe
1692	RegSvcs.exe
1692	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	1692	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2948	2892	ZIM Third PartyPlace ents.exe	28
PID 2892 wrote to memory of 2948	2892	ZIM Third PartyPlace ents.exe	28
PID 2892 wrote to memory of 2948	2892	ZIM Third PartyPlace ents.exe	28
PID 2892 wrote to memory of 2948	2892	ZIM Third PartyPlace ents.exe	28
PID 2892 wrote to memory of 2632	2892	ZIM Third PartyPlace ents.exe	30
PID 2892 wrote to memory of 2632	2892	ZIM Third PartyPlace ents.exe	30
PID 2892 wrote to memory of 2632	2892	ZIM Third PartyPlace ents.exe	30
PID 2892 wrote to memory of 2632	2892	ZIM Third PartyPlace ents.exe	30
PID 2892 wrote to memory of 2652	2892	ZIM Third PartyPlace ents.exe	32
PID 2892 wrote to memory of 2652	2892	ZIM Third PartyPlace ents.exe	32
PID 2892 wrote to memory of 2652	2892	ZIM Third PartyPlace ents.exe	32
PID 2892 wrote to memory of 2652	2892	ZIM Third PartyPlace ents.exe	32
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34
PID 2892 wrote to memory of 1692	2892	ZIM Third PartyPlace ents.exe	34

C:\Users\Admin\AppData\Local\Temp\ZIM Third PartyPlace ents.exe
"C:\Users\Admin\AppData\Local\Temp\ZIM Third PartyPlace ents.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ZIM Third PartyPlace ents.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TKuEOTfesQN.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TKuEOTfesQN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6519.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6519.tmp

Filesize
1KB

MD5
bfeb054a608d5ac614e8a889e37bcbd5

SHA1
93cacc32676f97ee2bb342d658c2a2c367968fa8

SHA256
533dab18eb4e9f4124d6bf27e8c78b01627d962f61f980bd7c13f8a0bee873ce

SHA512
09b4bc59c511e7abbbb2e2090c86f32f9027e8406e048270d1ba8a63ac24215d55052aaf44cb3da045d161096ec4d8cd41f82691f16c87d3875ba78fa90437f6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B1C30EBGMSTLFGG9JTYB.temp

Filesize
7KB

MD5
601e1e11d382e52787b793c513acc9ef

SHA1
254f3760d4edca43679ff323656a3b03b5f0a440

SHA256
b293459bf90ae6357f6065bd99448898bcc763dae4a01c7ec2cd757be1cb7e6a

SHA512
f17c059beb7174477af89aca4398fe6363c63368a69a374a67331ed71366fffd3b0b7249dcd596e1781810f1bc6112f55aae3881d47bbc759a993672b0f46f8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
601e1e11d382e52787b793c513acc9ef

SHA1
254f3760d4edca43679ff323656a3b03b5f0a440

SHA256
b293459bf90ae6357f6065bd99448898bcc763dae4a01c7ec2cd757be1cb7e6a

SHA512
f17c059beb7174477af89aca4398fe6363c63368a69a374a67331ed71366fffd3b0b7249dcd596e1781810f1bc6112f55aae3881d47bbc759a993672b0f46f8f

Download Submit
memory/1692-42-0x0000000004970000-0x00000000049B0000-memory.dmp

Filesize
256KB

Download
memory/1692-41-0x0000000074E10000-0x00000000754FE000-memory.dmp

Filesize
6.9MB

Download
memory/1692-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1692-37-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1692-35-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1692-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1692-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1692-45-0x0000000074E10000-0x00000000754FE000-memory.dmp

Filesize
6.9MB

Download
memory/1692-46-0x0000000004970000-0x00000000049B0000-memory.dmp

Filesize
256KB

Download
memory/1692-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1692-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1692-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2632-25-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2632-43-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2632-23-0x00000000029F0000-0x0000000002A30000-memory.dmp

Filesize
256KB

Download
memory/2632-22-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2892-5-0x00000000008B0000-0x00000000008BA000-memory.dmp

Filesize
40KB

Download
memory/2892-40-0x0000000074E10000-0x00000000754FE000-memory.dmp

Filesize
6.9MB

Download
memory/2892-1-0x0000000074E10000-0x00000000754FE000-memory.dmp

Filesize
6.9MB

Download
memory/2892-8-0x0000000000870000-0x00000000008B0000-memory.dmp

Filesize
256KB

Download
memory/2892-7-0x0000000074E10000-0x00000000754FE000-memory.dmp

Filesize
6.9MB

Download
memory/2892-6-0x0000000006180000-0x00000000061FA000-memory.dmp

Filesize
488KB

Download
memory/2892-2-0x0000000000870000-0x00000000008B0000-memory.dmp

Filesize
256KB

Download
memory/2892-4-0x00000000007F0000-0x00000000007F8000-memory.dmp

Filesize
32KB

Download
memory/2892-3-0x0000000004410000-0x000000000442A000-memory.dmp

Filesize
104KB

Download
memory/2892-0-0x0000000000940000-0x0000000000A22000-memory.dmp

Filesize
904KB

Download
memory/2948-24-0x0000000001E40000-0x0000000001E80000-memory.dmp

Filesize
256KB

Download
memory/2948-44-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2948-26-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2948-21-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads