agenttesla | 22be2df4064414d9208f52a39a0fa6dd03b3a4ce83f8702abb901573435f8b23

General

Target

4d2e36e66c0a6b7552b97bd5034fdcbb.exe
Size

434KB
MD5

4d2e36e66c0a6b7552b97bd5034fdcbb
SHA1

9bc9f2fd6c25810ee03a0512a8e3e621c0b1e8ad
SHA256

22be2df4064414d9208f52a39a0fa6dd03b3a4ce83f8702abb901573435f8b23
SHA512

ac8a8862baa8d379bcdd153ba4963b23b1b60a4f3adef7fc107418cf9bcc81220a25bba9db69d27f8bd5ef35611419829ef9b435d39e8b78275b1fefa3b7c060
SSDEEP

6144:Oy/wN2rJ33Fx3uFDUoz3i4IqYqTmIn6jgto/uAI/7k0NNXtUaQeVVZtDw8XDFOkm:OIrFrjSi4IqYfRgtkyTdUXi3zFwVK4

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.mohhg.com
Port:
587
Username:
[email protected]
Password:
QmlgN@@qt$53

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 5 IoCs

resource	yara_rule
behavioral1/memory/2752-20-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2752-18-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2752-16-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2752-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2752-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2612	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2612	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	28
PID 2164 wrote to memory of 2612	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	28
PID 2164 wrote to memory of 2612	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	28
PID 2164 wrote to memory of 2612	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	28
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29
PID 2164 wrote to memory of 2752	2164	4d2e36e66c0a6b7552b97bd5034fdcbb.exe	29

C:\Users\Admin\AppData\Local\Temp\4d2e36e66c0a6b7552b97bd5034fdcbb.exe
"C:\Users\Admin\AppData\Local\Temp\4d2e36e66c0a6b7552b97bd5034fdcbb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NNBvRA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAC37.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\4d2e36e66c0a6b7552b97bd5034fdcbb.exe
  "{path}"
  2⤵
  PID:2752
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 520
    3⤵
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAC37.tmp

Filesize
1KB

MD5
58c49d3cd25ff33f63f9084b35f61052

SHA1
7ceb091727d0875176f37bf802e166c4cc2d51ca

SHA256
4e42d5f477bec30a1c73e154f8df33d8d43eccca538785a8a94ca48befc65848

SHA512
59ffb3c10b7ac978e9678bc08ed64f0a345a4ebf60874d9ba97198559383da483e9d5bdaf128f66ca72cf0cef00704380ee5bdba3efc0c388f5ad88335f15f84

Download Submit
memory/2164-1-0x0000000000AE0000-0x0000000000B20000-memory.dmp

Filesize
256KB

Download
memory/2164-2-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/2164-0-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/2164-4-0x0000000000AE0000-0x0000000000B20000-memory.dmp

Filesize
256KB

Download
memory/2164-3-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/2164-21-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/2552-24-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2752-23-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/2752-22-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/2752-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2752-25-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads