agenttesla | ef886056d9a8c2089d72c3336475d27303f13c5c14085351a7897d677a848cc8

General

Target

YU SV Payment.exe
Size

716KB
MD5

b27d59190142193a25e728f708a2723c
SHA1

64374d07e20daa15d8f02ad0d2f40458a67fbbca
SHA256

0e2ca3a22077ff6c9460e2033e1e53419053336bb81973252a764f56497a52c6
SHA512

4839bc0f24c7a09e85dbdf0116bd31a34b58511862676766337d9fae2dfe5c658fa9132db310dcef0a0512120a902cc8d79c7baf78de63b0f265b5321e02b7bd
SSDEEP

12288:j5zScVfJTMK+r8fmCwnhZby00RCjs3gwmsYGu9pxA5k1kR:tzSOb26B8hZbz0Ys+Wu/I

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
zqamcx.com
Port:
587
Username:
[email protected]
Password:
Methodman991
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 1040	2736	YU SV Payment.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
2736	YU SV Payment.exe
1040	YU SV Payment.exe
1040	YU SV Payment.exe
688	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	YU SV Payment.exe
Token: SeDebugPrivilege	1040	YU SV Payment.exe
Token: SeDebugPrivilege	688	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1040	YU SV Payment.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 688	2736	YU SV Payment.exe	30
PID 2736 wrote to memory of 688	2736	YU SV Payment.exe	30
PID 2736 wrote to memory of 688	2736	YU SV Payment.exe	30
PID 2736 wrote to memory of 688	2736	YU SV Payment.exe	30
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32
PID 2736 wrote to memory of 1040	2736	YU SV Payment.exe	32

C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe
"C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe
  "C:\Users\Admin\AppData\Local\Temp\YU SV Payment.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4928.tmp

Filesize
44KB

MD5
2d1fe3e209b7db39f80a02213613d692

SHA1
de5df54bb15c37fe93bcd9e95d8a105326eb023f

SHA256
9264d9c50b323c60521283011e5502e8f1d0ac430f309a773adc6c1962ebce59

SHA512
21dc2d131e309f7bd154d90b520b4e72b1c43633f92b19542b95adcf7553ee8e1a3f8f25c08f3fdf2717d29e660340f715be29e3556f36ca763c9b906d5f1489

Download Submit
memory/688-126-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/688-129-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/688-128-0x0000000002930000-0x0000000002970000-memory.dmp

Filesize
256KB

Download
memory/688-127-0x000000006EAA0000-0x000000006F04B000-memory.dmp

Filesize
5.7MB

Download
memory/1040-123-0x0000000004390000-0x00000000043D0000-memory.dmp

Filesize
256KB

Download
memory/1040-118-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-131-0x0000000004390000-0x00000000043D0000-memory.dmp

Filesize
256KB

Download
memory/1040-130-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/1040-122-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/1040-106-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-108-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-110-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-112-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-114-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1040-116-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1040-120-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2736-102-0x00000000006B0000-0x00000000006C2000-memory.dmp

Filesize
72KB

Download
memory/2736-105-0x0000000006080000-0x00000000060C0000-memory.dmp

Filesize
256KB

Download
memory/2736-121-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2736-0-0x0000000000860000-0x0000000000916000-memory.dmp

Filesize
728KB

Download
memory/2736-101-0x0000000000560000-0x000000000056C000-memory.dmp

Filesize
48KB

Download
memory/2736-100-0x0000000000810000-0x000000000082C000-memory.dmp

Filesize
112KB

Download
memory/2736-99-0x0000000006080000-0x00000000060C0000-memory.dmp

Filesize
256KB

Download
memory/2736-1-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2736-104-0x00000000749C0000-0x00000000750AE000-memory.dmp

Filesize
6.9MB

Download
memory/2736-103-0x0000000000610000-0x0000000000694000-memory.dmp

Filesize
528KB

Download

Analysis

Sharing