agenttesla | 42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71

General

Target

42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe
Size

745KB
MD5

c906ddbbf6fbc2dc619e38fb0bc60bed
SHA1

982d1ff032d31eaaf17dc4c992a0d7ffa2cc5674
SHA256

42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71
SHA512

244568534004fe7d2a76f01a98fbf2dc6f03d57c7ee370fedcf80756018923fdd6178e8161ad1183616f0927923874a7274576db3d3dca979ba0419730dc5784
SSDEEP

12288:RSqjxkzqHKMbZnkEE3DB0fkhlW1KzHOH86KC4+zczZEn8kILSbKX7yrp34a6E2ur:R7+z87bZC3DB0SAIzHOcQ4eIZZ/ta6ET

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.wasstech.com
Port:
587
Username:
[email protected]
Password:
Sunray2700@@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 6 IoCs

resource	yara_rule
behavioral1/memory/2728-35-0x0000000002A20000-0x0000000002A60000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2468-45-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2468-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2468-39-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2468-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs

resource	yara_rule
behavioral1/memory/2728-35-0x0000000002A20000-0x0000000002A60000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2468-45-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2468-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2468-39-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2468-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 6 IoCs

resource	yara_rule
behavioral1/memory/2728-35-0x0000000002A20000-0x0000000002A60000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2468-45-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2468-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2468-39-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2468-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2728-35-0x0000000002A20000-0x0000000002A60000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2468-45-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2468-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2468-39-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2468-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2728-35-0x0000000002A20000-0x0000000002A60000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2468-45-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2468-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2468-39-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2468-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2728-35-0x0000000002A20000-0x0000000002A60000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2468-45-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2468-42-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2468-39-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2468-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2468-26-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3048 set thread context of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe
2920	powershell.exe
2728	powershell.exe
3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe
2468	RegSvcs.exe
2468	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2468	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2920	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	29
PID 3048 wrote to memory of 2920	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	29
PID 3048 wrote to memory of 2920	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	29
PID 3048 wrote to memory of 2920	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	29
PID 3048 wrote to memory of 2728	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	34
PID 3048 wrote to memory of 2728	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	34
PID 3048 wrote to memory of 2728	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	34
PID 3048 wrote to memory of 2728	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	34
PID 3048 wrote to memory of 2580	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	31
PID 3048 wrote to memory of 2580	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	31
PID 3048 wrote to memory of 2580	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	31
PID 3048 wrote to memory of 2580	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	31
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32
PID 3048 wrote to memory of 2468	3048	42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe	32

C:\Users\Admin\AppData\Local\Temp\42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe
"C:\Users\Admin\AppData\Local\Temp\42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\42f49c36922c915d7bd0504bb1893842a2712c83616191bad4537fb00ff4bb71.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pjXsuZUE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp495F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pjXsuZUE.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp495F.tmp

Filesize
1KB

MD5
2770bade85f2eb0f76047dcd6b17643c

SHA1
829966fcac32ad49bebf63e81f3ca92a1e831f7f

SHA256
dc3c26f03826f02b58b983d8eaa52dc3528709dc319d117a59fab2315add6263

SHA512
75c1de8f49e0ebedfa44df0e92d0f6c2d267150af860be1e10d85bdbf591ee8eff48457820ffcec0dccb76538cfa2f717a54131646c183168da0363f7ad5ea97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LMOU2UBZ8QNYMUR26DIR.temp

Filesize
7KB

MD5
c1a2b5aac23cdcb7bb10a80dbabb1d59

SHA1
5cb41566b9ffe81c015f37ec5bd7ae27ec3c482d

SHA256
7d2381276b27611f22610d5e0531cca43fd09175347c1190ba104afa904f5fbd

SHA512
5365e881a66d6082159174846f662f5405a11e7a467eadc1f97bb48a81aa3a12ecd0344175e321d242fc46246e87c8437a2cc9c93b7b2ef225d5766b1fef5642

Download Submit
memory/2468-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-65-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2468-64-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/2468-47-0x00000000048E0000-0x0000000004920000-memory.dmp

Filesize
256KB

Download
memory/2468-46-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/2468-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2468-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-42-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2468-45-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2728-35-0x0000000002A20000-0x0000000002A60000-memory.dmp

Filesize
256KB

Download
memory/2728-29-0x000000006E8E0000-0x000000006EE8B000-memory.dmp

Filesize
5.7MB

Download
memory/2728-33-0x0000000002A20000-0x0000000002A60000-memory.dmp

Filesize
256KB

Download
memory/2728-40-0x0000000002A20000-0x0000000002A60000-memory.dmp

Filesize
256KB

Download
memory/2728-27-0x000000006E8E0000-0x000000006EE8B000-memory.dmp

Filesize
5.7MB

Download
memory/2728-49-0x000000006E8E0000-0x000000006EE8B000-memory.dmp

Filesize
5.7MB

Download
memory/2728-20-0x000000006E8E0000-0x000000006EE8B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-31-0x0000000000210000-0x0000000000250000-memory.dmp

Filesize
256KB

Download
memory/2920-48-0x000000006E8E0000-0x000000006EE8B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-37-0x0000000000210000-0x0000000000250000-memory.dmp

Filesize
256KB

Download
memory/2920-25-0x000000006E8E0000-0x000000006EE8B000-memory.dmp

Filesize
5.7MB

Download
memory/2920-38-0x0000000000210000-0x0000000000250000-memory.dmp

Filesize
256KB

Download
memory/2920-23-0x000000006E8E0000-0x000000006EE8B000-memory.dmp

Filesize
5.7MB

Download
memory/3048-0-0x0000000000FB0000-0x0000000001070000-memory.dmp

Filesize
768KB

Download
memory/3048-1-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3048-2-0x0000000002530000-0x0000000002570000-memory.dmp

Filesize
256KB

Download
memory/3048-6-0x0000000004FE0000-0x0000000005068000-memory.dmp

Filesize
544KB

Download
memory/3048-43-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/3048-3-0x0000000000350000-0x0000000000364000-memory.dmp

Filesize
80KB

Download
memory/3048-4-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/3048-5-0x00000000004F0000-0x00000000004FE000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads