agenttesla | 7c4cd03c4541288c1a325c5b34f38b800fc991ea96d1681f037efc1f5f7e6cef

General

Target

SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe
Size

709KB
MD5

2b578c0a73abc237814bdf0dcf080663
SHA1

4b35c0b021d9db211fcbce84a6bde2a63b3d184e
SHA256

7c4cd03c4541288c1a325c5b34f38b800fc991ea96d1681f037efc1f5f7e6cef
SHA512

e08bbf22260c9379464542016585a725147c93d7a5abb909b9705003a55425ac08e5f79cf8f089d2de8f90cc03084ee4c15b6b79f849c697bf2ad96c4261676a
SSDEEP

12288:lBtKZ/jr6S7JH4ydz8AZdGidwLdzepVZifNDeMV2KNH9Qkecyb6nOSt:AZ/jnVbTldwtgEDZv7eHV

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.rrcindia.co.in
Port:
587
Username:
[email protected]
Password:
Goyal@0783
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe
2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe
2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe
2572	RegSvcs.exe
2572	RegSvcs.exe
2556	powershell.exe
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe
Token: SeDebugPrivilege	2572	RegSvcs.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2556	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	28
PID 2868 wrote to memory of 2556	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	28
PID 2868 wrote to memory of 2556	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	28
PID 2868 wrote to memory of 2556	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	28
PID 2868 wrote to memory of 2628	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	30
PID 2868 wrote to memory of 2628	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	30
PID 2868 wrote to memory of 2628	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	30
PID 2868 wrote to memory of 2628	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	30
PID 2868 wrote to memory of 2644	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	32
PID 2868 wrote to memory of 2644	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	32
PID 2868 wrote to memory of 2644	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	32
PID 2868 wrote to memory of 2644	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	32
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34
PID 2868 wrote to memory of 2572	2868	SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe	34

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.2735.29595.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ggxnVDRjlySVxq.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ggxnVDRjlySVxq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAC94.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpAC94.tmp

Filesize
1KB

MD5
85b196f667e8e348f804c001ce6a54f6

SHA1
1ed2d76e757d399342bcf1c72c6266e01a7518d0

SHA256
88218123717c0d27e0f2b483fba5b38f0dd410991f48456b23f7e6429e2b7205

SHA512
73198443c76dbb3fb912b27dfb652484eddc1a8a1c35b2d210b914c766a6a453fdf467d94463e2bfe5ab1e73d68840ec9e98049464a11c43cca56d62edfdac6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
72ed0bb54e663c08bbe03560d20dfcab

SHA1
7b6597d623a90aa375783aa446c595099de2f5af

SHA256
fcd6d88330b56810fec9da88f3241bd5cb2bf531f273d178a66b870ce127b22e

SHA512
100c341ca667b4281707e8188d38a8cdc2b66720af40e5901729f8f9cf65fd629e8402f0f59451cdef27779e69fd80cdf652b48c5bf1db52c2b5219b622451ec

Download Submit
memory/2556-44-0x000000006E310000-0x000000006E8BB000-memory.dmp

Filesize
5.7MB

Download
memory/2556-42-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2556-38-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2556-35-0x00000000025C0000-0x0000000002600000-memory.dmp

Filesize
256KB

Download
memory/2556-26-0x000000006E310000-0x000000006E8BB000-memory.dmp

Filesize
5.7MB

Download
memory/2556-20-0x000000006E310000-0x000000006E8BB000-memory.dmp

Filesize
5.7MB

Download
memory/2572-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-36-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-47-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/2572-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-46-0x0000000073540000-0x0000000073C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2572-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-41-0x0000000073540000-0x0000000073C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2572-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2572-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2628-28-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/2628-33-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/2628-32-0x000000006E310000-0x000000006E8BB000-memory.dmp

Filesize
5.7MB

Download
memory/2628-22-0x000000006E310000-0x000000006E8BB000-memory.dmp

Filesize
5.7MB

Download
memory/2628-45-0x000000006E310000-0x000000006E8BB000-memory.dmp

Filesize
5.7MB

Download
memory/2628-43-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/2868-5-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2868-3-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download
memory/2868-1-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-37-0x0000000074860000-0x0000000074F4E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-2-0x0000000004F50000-0x0000000004F90000-memory.dmp

Filesize
256KB

Download
memory/2868-0-0x00000000008B0000-0x0000000000968000-memory.dmp

Filesize
736KB

Download
memory/2868-4-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/2868-6-0x0000000004F90000-0x0000000005012000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads