agenttesla | 95f43a10f2f0b5d86c4ccf9f580ebd5210bb1dae0760c3e2b023c0f35a765859

General

Target

order RFQ-HL51L05....exe
Size

674KB
MD5

866137b981aae418d04b64b674946169
SHA1

5ef67bd192161ae77bfc79c0e39ef8f75459c61e
SHA256

61c5ce1a7b1f3351096bb164754cdbe0b33cd240bd23d5f2a7226160d37b3350
SHA512

97c94e9ad062e4b035445e1158bc84b399aace23b86ae54c202d3ef0889b3ee8ad51f4e72b92210fde97fec9c700acf2511e8fd2aa6ce581c126b2cd35cb3df3
SSDEEP

12288:UXBgOWP6iqpEmQepZEJiI5uviFy0RYJ/vqcN1P+R048azE2ogpu0NxPvUzHGq:QCkpENJ+iFy0AycNds048azEhg80NuLG

Score

10^/10

agenttesla zgrat keylogger rat spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.elec-qatar.com
Port:
587
Username:
[email protected]
Password:
MHabrar2019@#
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2832-3-0x00000000004C0000-0x00000000004D8000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

order RFQ-HL51L05....exe

description pid process target process

PID 2832 set thread context of 2720 2832 order RFQ-HL51L05....exe order RFQ-HL51L05....exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2736 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

order RFQ-HL51L05....exepowershell.exeorder RFQ-HL51L05....exe

pid process

2832 order RFQ-HL51L05....exe
2832 order RFQ-HL51L05....exe
2820 powershell.exe
2720 order RFQ-HL51L05....exe
2720 order RFQ-HL51L05....exe

description	pid	process	target process
PID 2832 set thread context of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe

pid	process
2736	schtasks.exe

pid	process
2832	order RFQ-HL51L05....exe
2832	order RFQ-HL51L05....exe
2820	powershell.exe
2720	order RFQ-HL51L05....exe
2720	order RFQ-HL51L05....exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

order RFQ-HL51L05....exepowershell.exeorder RFQ-HL51L05....exe

description	pid	process
Token: SeDebugPrivilege	2832	order RFQ-HL51L05....exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2720	order RFQ-HL51L05....exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

order RFQ-HL51L05....exe

description	pid	process	target process
PID 2832 wrote to memory of 2820	2832	order RFQ-HL51L05....exe	powershell.exe
PID 2832 wrote to memory of 2820	2832	order RFQ-HL51L05....exe	powershell.exe
PID 2832 wrote to memory of 2820	2832	order RFQ-HL51L05....exe	powershell.exe
PID 2832 wrote to memory of 2820	2832	order RFQ-HL51L05....exe	powershell.exe
PID 2832 wrote to memory of 2736	2832	order RFQ-HL51L05....exe	schtasks.exe
PID 2832 wrote to memory of 2736	2832	order RFQ-HL51L05....exe	schtasks.exe
PID 2832 wrote to memory of 2736	2832	order RFQ-HL51L05....exe	schtasks.exe
PID 2832 wrote to memory of 2736	2832	order RFQ-HL51L05....exe	schtasks.exe
PID 2832 wrote to memory of 2684	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2684	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2684	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2684	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe
PID 2832 wrote to memory of 2720	2832	order RFQ-HL51L05....exe	order RFQ-HL51L05....exe

C:\Users\Admin\AppData\Local\Temp\order RFQ-HL51L05....exe
"C:\Users\Admin\AppData\Local\Temp\order RFQ-HL51L05....exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\THlTYy.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\THlTYy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp86CC.tmp"
2⤵
- Creates scheduled task(s)
PID:2736

C:\Users\Admin\AppData\Local\Temp\order RFQ-HL51L05....exe
"C:\Users\Admin\AppData\Local\Temp\order RFQ-HL51L05....exe"
2⤵
PID:2684

C:\Users\Admin\AppData\Local\Temp\order RFQ-HL51L05....exe
"C:\Users\Admin\AppData\Local\Temp\order RFQ-HL51L05....exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp86CC.tmp

Filesize
1KB

MD5
84f9991af22aea13bc44de306a4cf23b

SHA1
4a647d3509232209ba683e840ae70faf5a8be30a

SHA256
c82306376cdf67ea1b86380732b1198208b9b34af6a4dea2b18f4c273e3b2dd2

SHA512
7bb1f234656dbb0bc1076fc33bd5306d72f0df8698f8f9a56cadea7cf173d67e88f5b97f2d1e69d0d2ade83978f3561e47c3753f39d3d0e39af4de29f3b644d0

Download Submit
memory/2720-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-35-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/2720-33-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Filesize
256KB

Download
memory/2720-32-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/2720-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-36-0x0000000004A70000-0x0000000004AB0000-memory.dmp

Filesize
256KB

Download
memory/2720-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2720-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2820-29-0x000000006EA30000-0x000000006EFDB000-memory.dmp

Filesize
5.7MB

Download
memory/2820-28-0x000000006EA30000-0x000000006EFDB000-memory.dmp

Filesize
5.7MB

Download
memory/2820-31-0x0000000002840000-0x0000000002880000-memory.dmp

Filesize
256KB

Download
memory/2820-30-0x0000000002840000-0x0000000002880000-memory.dmp

Filesize
256KB

Download
memory/2820-34-0x000000006EA30000-0x000000006EFDB000-memory.dmp

Filesize
5.7MB

Download
memory/2832-25-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/2832-6-0x00000000059F0000-0x0000000005A6A000-memory.dmp

Filesize
488KB

Download
memory/2832-5-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2832-0-0x0000000000F10000-0x0000000000FBE000-memory.dmp

Filesize
696KB

Download
memory/2832-4-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/2832-3-0x00000000004C0000-0x00000000004D8000-memory.dmp

Filesize
96KB

Download
memory/2832-2-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2832-1-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads