agenttesla | 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef

General

Target

DETAILS.exe
Size

728KB
MD5

339649aa12a77cfcc09c7b07fc9d7f52
SHA1

038ef4d52e2553340063d713660a1c4aa1fb7619
SHA256

922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef
SHA512

c329d09e06adf39e27ea380ada1913ecf3ef4211c3edcd1f3c1515f55fc0e9360e256efe7f1adc57852e56905e0376b61c87151e543bf8461e2e12c5d52196c2
SSDEEP

12288:3JglQx+3ZRl5RY4btD+K5t7UQC4u88ildNMPbUrpOwD4muneIjRxmL87vWX1pfSf:ZpxQRhtV88dgbUdOwTunGL8j15ya0M

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.itresinc.com
Port:
587
Username:
[email protected]
Password:
MT]ANFjWzKTA
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

DETAILS.exe

description pid process target process

PID 2404 set thread context of 2924 2404 DETAILS.exe DETAILS.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2716 schtasks.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 2404 set thread context of 2924	2404	DETAILS.exe	DETAILS.exe

pid	process
2716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

DETAILS.exeDETAILS.exepowershell.exepowershell.exe

pid	process
2404	DETAILS.exe
2404	DETAILS.exe
2404	DETAILS.exe
2404	DETAILS.exe
2404	DETAILS.exe
2404	DETAILS.exe
2404	DETAILS.exe
2924	DETAILS.exe
2924	DETAILS.exe
2588	powershell.exe
2676	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

DETAILS.exeDETAILS.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2404	DETAILS.exe
Token: SeDebugPrivilege	2924	DETAILS.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

DETAILS.exe

description	pid	process	target process
PID 2404 wrote to memory of 2588	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2588	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2588	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2588	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2676	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2676	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2676	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2676	2404	DETAILS.exe	powershell.exe
PID 2404 wrote to memory of 2716	2404	DETAILS.exe	schtasks.exe
PID 2404 wrote to memory of 2716	2404	DETAILS.exe	schtasks.exe
PID 2404 wrote to memory of 2716	2404	DETAILS.exe	schtasks.exe
PID 2404 wrote to memory of 2716	2404	DETAILS.exe	schtasks.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe
PID 2404 wrote to memory of 2924	2404	DETAILS.exe	DETAILS.exe

C:\Users\Admin\AppData\Local\Temp\DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\DETAILS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DETAILS.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TQUDbFDZarHZ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TQUDbFDZarHZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp816F.tmp"
2⤵
- Creates scheduled task(s)
PID:2716

C:\Users\Admin\AppData\Local\Temp\DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\DETAILS.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp816F.tmp
Filesize
1KB

MD5
824b0a59b0c2cb4327f419d08bbcb15d

SHA1
9e40f66c5b8b0a08bc8ace1e50ab690ca1634c59

SHA256
4122623dc0ffa17dfdc3e17b4a487ad13e54b3869d119ff0f31211c1e021cb0b

SHA512
a1d7aef01538127638e5f5aa9471ea1807d0a4e85aeb6ef4bde5fe32277f17886beee62a34e2f42f7799558818dfcda62df482529e24c0a3e9035c3aae246db1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ULI0GWADQ6EOHONSUIHI.temp
Filesize
7KB

MD5
50aa86b8ce596f99b5f0ef0876e2416f

SHA1
e0897c3979a95e21e4b6676a65c6c5af3bae2465

SHA256
ba634cf540661f338f765cf410c9562119362063268ce80b798fa0766ba94d0e

SHA512
23e5738fd0e9f3dacce9e2447e515120a3d4621637c2399ebcd0758e9820cf0f4345a4488b0c64ed1151aea61b573fa185db121959fa1778a755bc641888c3a0

Download Submit
memory/2404-3-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download
memory/2404-34-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2404-4-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/2404-5-0x0000000005DC0000-0x0000000005E44000-memory.dmp

Filesize
528KB

Download
memory/2404-2-0x0000000004240000-0x0000000004280000-memory.dmp

Filesize
256KB

Download
memory/2404-1-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2404-20-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2404-0-0x00000000002D0000-0x000000000038A000-memory.dmp

Filesize
744KB

Download
memory/2588-45-0x000000006E270000-0x000000006E81B000-memory.dmp

Filesize
5.7MB

Download
memory/2588-41-0x0000000002620000-0x0000000002660000-memory.dmp

Filesize
256KB

Download
memory/2588-39-0x0000000002620000-0x0000000002660000-memory.dmp

Filesize
256KB

Download
memory/2588-37-0x000000006E270000-0x000000006E81B000-memory.dmp

Filesize
5.7MB

Download
memory/2588-35-0x000000006E270000-0x000000006E81B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-38-0x000000006E270000-0x000000006E81B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-42-0x000000006E270000-0x000000006E81B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-44-0x000000006E270000-0x000000006E81B000-memory.dmp

Filesize
5.7MB

Download
memory/2676-40-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/2676-36-0x0000000001CA0000-0x0000000001CE0000-memory.dmp

Filesize
256KB

Download
memory/2924-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2924-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-43-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2924-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2924-46-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/2924-47-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads