agenttesla | 64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a

General

Target

64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
Size

1002KB
MD5

e82d4b80d1ee59fa32a8cc692eb667a8
SHA1

410e414d332b65b16f888a873d0c2842fb0c03e3
SHA256

64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a
SHA512

dd0c5e70a026e666b7ef5d722683043cf4d4b8de3284c070556e55d7e66d60208147c6272462d087b20f4342635556074d086706a06668fbef01dabef8d57480
SSDEEP

24576:qMyULPrDTQB2mspOLbuU0kqwlHdkngrzZlNE:vDTm2vpQuUlqwdkgrzBE

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.aranybarany.hu
Port:
587
Username:
[email protected]
Password:
18Szalloda94
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
2584	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
2584	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
2916	powershell.exe
2724	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
Token: SeDebugPrivilege	2584	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2724	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	28
PID 2472 wrote to memory of 2724	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	28
PID 2472 wrote to memory of 2724	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	28
PID 2472 wrote to memory of 2724	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	28
PID 2472 wrote to memory of 2916	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	30
PID 2472 wrote to memory of 2916	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	30
PID 2472 wrote to memory of 2916	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	30
PID 2472 wrote to memory of 2916	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	30
PID 2472 wrote to memory of 2372	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	32
PID 2472 wrote to memory of 2372	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	32
PID 2472 wrote to memory of 2372	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	32
PID 2472 wrote to memory of 2372	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	32
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34
PID 2472 wrote to memory of 2584	2472	64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe	34

C:\Users\Admin\AppData\Local\Temp\64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
"C:\Users\Admin\AppData\Local\Temp\64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DfwhjreF.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DfwhjreF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D39.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe
  "C:\Users\Admin\AppData\Local\Temp\64ffddfdb7b226084feb2a9e18045946f75e34277c7447515c6db7f1222a766a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9D39.tmp

Filesize
1KB

MD5
4d76d69f27d715835a615d3a7fd2d5eb

SHA1
76231941c30ade1bbbb60ae6226c4453f5cde306

SHA256
13455e3f492ceb0bf51890c8e0789db0e99aa6883b03cbc3e3e91e65a322af8c

SHA512
661ff6a93dc84e129c93246101e3ba0eefd39b4bb1a2187ec0e821621decd81708b08ffd9bfbea476fef1d5e2aa5dbc917b420b0180f33a2931275b7cbc6e755

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MS1KCQSPYHEACNUWMJI4.temp

Filesize
7KB

MD5
77de2bd8241160d7a39207b4e03f07dc

SHA1
16c8c6a63c0d41172e9f9d96762c3d429442bbd4

SHA256
508d8cb89e19c00d37b39d1008543d2584e908b77857cf7d1a6668aba4395bdd

SHA512
13b209494730d9de079ed03987330f1f919e2062c2b779314645247b026f8f4ed8e46eacc5e74fb35e5bea54aa50a6460390e4b55a7a908ba5a5f900766e90f5

Download Submit
memory/2472-21-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download
memory/2472-1-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2472-2-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download
memory/2472-3-0x0000000000530000-0x000000000054C000-memory.dmp

Filesize
112KB

Download
memory/2472-4-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/2472-5-0x00000000005B0000-0x00000000005C4000-memory.dmp

Filesize
80KB

Download
memory/2472-6-0x0000000005C80000-0x0000000005D02000-memory.dmp

Filesize
520KB

Download
memory/2472-19-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2472-32-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2472-0-0x00000000001A0000-0x00000000002A0000-memory.dmp

Filesize
1024KB

Download
memory/2584-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2584-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-39-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2584-41-0x0000000004BB0000-0x0000000004BF0000-memory.dmp

Filesize
256KB

Download
memory/2584-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2584-44-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2724-35-0x0000000002160000-0x00000000021A0000-memory.dmp

Filesize
256KB

Download
memory/2724-43-0x000000006DEB0000-0x000000006E45B000-memory.dmp

Filesize
5.7MB

Download
memory/2724-33-0x000000006DEB0000-0x000000006E45B000-memory.dmp

Filesize
5.7MB

Download
memory/2724-40-0x000000006DEB0000-0x000000006E45B000-memory.dmp

Filesize
5.7MB

Download
memory/2916-34-0x000000006DEB0000-0x000000006E45B000-memory.dmp

Filesize
5.7MB

Download
memory/2916-38-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/2916-37-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/2916-42-0x000000006DEB0000-0x000000006E45B000-memory.dmp

Filesize
5.7MB

Download
memory/2916-36-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads