agenttesla | 3f1ecc5ad2ba9ce4ac4e8c38ad57feea77c99077bdbaba259054e87d32fbaa81

General

Target

URGENT REQUEST FOR QUOTATION.exe
Size

694KB
MD5

47cfd7df0907f049cb95d36e82e2a60b
SHA1

97ccc9a37ca3c281f6d15e45b393a831109c8caa
SHA256

15d92d97b0d9181ef3a9270baa8d36b15f6e5c61a8c26ebceffcb3af2d06b527
SHA512

4621674c28eb6cd86d24727a4aef42ff93bbd9012eea899f726e60acbffc51f97bb3d95ed91d40fda57ab9951a499ce92ecce9d99d0007e5b4ac08eb27652537
SSDEEP

12288:AJJ4NOlWlrfYer1AAMJ8soKIt8MKjtEsnab0VA0OGX7ZcGHWhjm5kR:AaEldJ8zK3MKpEsnab0VTOGX7RH+jmk

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mcltransindo.com
Port:
587
Username:
[email protected]
Password:
mcltelv#06032019#
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1244	URGENT REQUEST FOR QUOTATION.exe
1244	URGENT REQUEST FOR QUOTATION.exe
1244	URGENT REQUEST FOR QUOTATION.exe
1244	URGENT REQUEST FOR QUOTATION.exe
1244	URGENT REQUEST FOR QUOTATION.exe
1244	URGENT REQUEST FOR QUOTATION.exe
2656	powershell.exe
2900	powershell.exe
1244	URGENT REQUEST FOR QUOTATION.exe
2480	RegSvcs.exe
2480	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	URGENT REQUEST FOR QUOTATION.exe
Token: SeDebugPrivilege	2656	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2480	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2900	1244	URGENT REQUEST FOR QUOTATION.exe	28
PID 1244 wrote to memory of 2900	1244	URGENT REQUEST FOR QUOTATION.exe	28
PID 1244 wrote to memory of 2900	1244	URGENT REQUEST FOR QUOTATION.exe	28
PID 1244 wrote to memory of 2900	1244	URGENT REQUEST FOR QUOTATION.exe	28
PID 1244 wrote to memory of 2656	1244	URGENT REQUEST FOR QUOTATION.exe	30
PID 1244 wrote to memory of 2656	1244	URGENT REQUEST FOR QUOTATION.exe	30
PID 1244 wrote to memory of 2656	1244	URGENT REQUEST FOR QUOTATION.exe	30
PID 1244 wrote to memory of 2656	1244	URGENT REQUEST FOR QUOTATION.exe	30
PID 1244 wrote to memory of 2928	1244	URGENT REQUEST FOR QUOTATION.exe	32
PID 1244 wrote to memory of 2928	1244	URGENT REQUEST FOR QUOTATION.exe	32
PID 1244 wrote to memory of 2928	1244	URGENT REQUEST FOR QUOTATION.exe	32
PID 1244 wrote to memory of 2928	1244	URGENT REQUEST FOR QUOTATION.exe	32
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34
PID 1244 wrote to memory of 2480	1244	URGENT REQUEST FOR QUOTATION.exe	34

C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\URGENT REQUEST FOR QUOTATION.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BIDysVy.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BIDysVy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp63F1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp63F1.tmp

Filesize
1KB

MD5
cef10011368a36fc74f2078f0db58fb7

SHA1
48cf186eee4e7dcd52a39c76a17c18b0958fdc1f

SHA256
01e66e4c95a55986f7f7825d5e9fe061255ac070c5f88eb7b7007bde2bf8e07e

SHA512
1ef097ce4f74ac1d51b48b1df4ff2e8727477611fc51b7aa9471c158a476716851b048d1bc0ae1fe2a4f6e5e64f43aa3fea7a13c8a0542a64e6f5a697608cc3c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
2a7688a42414f79f030139d9f100f27c

SHA1
df8c01517343da1e95f684b8edebed1911de2c44

SHA256
f97e4eb0e1e83db9cd49265a82662762e33ed0104f5d7ebcc3501486d1d3e8ce

SHA512
9a7d1e52941df7aa83c5a78b6ece84fc529727eb6d724b3fbd7b6a3df7be32283937548b4e8bb59595bfcd504046a02bb75504c4952c9e28652ee9a7d30191a1

Download Submit
memory/1244-41-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1244-0-0x0000000000370000-0x0000000000420000-memory.dmp

Filesize
704KB

Download
memory/1244-2-0x0000000004F70000-0x0000000004FB0000-memory.dmp

Filesize
256KB

Download
memory/1244-3-0x0000000000520000-0x0000000000534000-memory.dmp

Filesize
80KB

Download
memory/1244-4-0x0000000000550000-0x000000000055A000-memory.dmp

Filesize
40KB

Download
memory/1244-5-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download
memory/1244-6-0x00000000021D0000-0x0000000002254000-memory.dmp

Filesize
528KB

Download
memory/1244-19-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1244-1-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/1244-35-0x0000000004F70000-0x0000000004FB0000-memory.dmp

Filesize
256KB

Download
memory/2480-49-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/2480-44-0x00000000749D0000-0x00000000750BE000-memory.dmp

Filesize
6.9MB

Download
memory/2480-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-43-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2480-45-0x00000000006C0000-0x0000000000700000-memory.dmp

Filesize
256KB

Download
memory/2480-38-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-31-0x0000000001DD0000-0x0000000001E10000-memory.dmp

Filesize
256KB

Download
memory/2656-33-0x0000000001DD0000-0x0000000001E10000-memory.dmp

Filesize
256KB

Download
memory/2656-29-0x000000006F850000-0x000000006FDFB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-25-0x0000000001DD0000-0x0000000001E10000-memory.dmp

Filesize
256KB

Download
memory/2656-46-0x000000006F850000-0x000000006FDFB000-memory.dmp

Filesize
5.7MB

Download
memory/2656-20-0x000000006F850000-0x000000006FDFB000-memory.dmp

Filesize
5.7MB

Download
memory/2900-37-0x0000000002910000-0x0000000002950000-memory.dmp

Filesize
256KB

Download
memory/2900-27-0x000000006F850000-0x000000006FDFB000-memory.dmp

Filesize
5.7MB

Download
memory/2900-23-0x0000000002910000-0x0000000002950000-memory.dmp

Filesize
256KB

Download
memory/2900-21-0x000000006F850000-0x000000006FDFB000-memory.dmp

Filesize
5.7MB

Download
memory/2900-47-0x000000006F850000-0x000000006FDFB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads