agenttesla | 0e3829a03b5d78e96c929e089ef91ca74c2e3bf3bdc1b263c9409c0d35b5166a

General

Target

RCP000004689 Scan Copy.exe
Size

689KB
MD5

ff97d529e83654c94df6de34f1868dae
SHA1

c544e17962e634fb0866a3fc798a820dacd04d1c
SHA256

0e3829a03b5d78e96c929e089ef91ca74c2e3bf3bdc1b263c9409c0d35b5166a
SHA512

9e7a118dabeb8f9e583487e7903815202b69bda5a79f63f054a826341463d5876c9d8185b99695f988231e670249a72e228b80d8a9e084c95611523abdceb469
SSDEEP

12288:HUzWSsykmrzmac+vB5yG5CWcV4NKeHe1+YuDqZFr1KY9bh4CMwjN:HSmykszmw75CZ+0eHek1q1KY93N

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
sg2plcpnl0128.prod.sin2.secureserver.net
Port:
587
Username:
[email protected]
Password:
oc27-JcbRAO~
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

RCP000004689 Scan Copy.exe

description pid process target process

PID 1656 set thread context of 2396 1656 RCP000004689 Scan Copy.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2548 schtasks.exe

flow	ioc
6	api.ipify.org
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 1656 set thread context of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe

pid	process
2548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

RCP000004689 Scan Copy.exeRegSvcs.exepowershell.exepowershell.exe

pid	process
1656	RCP000004689 Scan Copy.exe
1656	RCP000004689 Scan Copy.exe
1656	RCP000004689 Scan Copy.exe
1656	RCP000004689 Scan Copy.exe
1656	RCP000004689 Scan Copy.exe
1656	RCP000004689 Scan Copy.exe
1656	RCP000004689 Scan Copy.exe
1656	RCP000004689 Scan Copy.exe
2396	RegSvcs.exe
2396	RegSvcs.exe
2492	powershell.exe
2608	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

RCP000004689 Scan Copy.exeRegSvcs.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1656	RCP000004689 Scan Copy.exe
Token: SeDebugPrivilege	2396	RegSvcs.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

RCP000004689 Scan Copy.exe

description	pid	process	target process
PID 1656 wrote to memory of 2492	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2492	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2492	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2492	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2608	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2608	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2608	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2608	1656	RCP000004689 Scan Copy.exe	powershell.exe
PID 1656 wrote to memory of 2548	1656	RCP000004689 Scan Copy.exe	schtasks.exe
PID 1656 wrote to memory of 2548	1656	RCP000004689 Scan Copy.exe	schtasks.exe
PID 1656 wrote to memory of 2548	1656	RCP000004689 Scan Copy.exe	schtasks.exe
PID 1656 wrote to memory of 2548	1656	RCP000004689 Scan Copy.exe	schtasks.exe
PID 1656 wrote to memory of 2380	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2380	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2380	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2380	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2380	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2380	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2380	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2784	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2784	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2784	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2784	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2784	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2784	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2784	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2860	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2860	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2860	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2860	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2860	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2860	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2860	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe
PID 1656 wrote to memory of 2396	1656	RCP000004689 Scan Copy.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\RCP000004689 Scan Copy.exe
"C:\Users\Admin\AppData\Local\Temp\RCP000004689 Scan Copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RCP000004689 Scan Copy.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qHqJcuLw.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHqJcuLw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46D0.tmp"
2⤵
- Creates scheduled task(s)
PID:2548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp46D0.tmp
Filesize
1KB

MD5
eaa613f466e4390e1589749e6549584f

SHA1
624e369d946eb7a9fec92cee2f87440c89cedb94

SHA256
bddcf0e67ed52706fefe6a1c71a72ed63934e21b86c3e80e139595c2218e5578

SHA512
63571924e835213a24e296fcc43d81259cb28a59b0efa7b3075448782752b4fc696ea9ed328b856f03dd7d6e458edf8c47265b50e8552857e814c17c5d53d3a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
9b0eb0437c7e8f1874aa1a6fd126ad0e

SHA1
316c47bd32cabd1af08d51adf6b05a27d2519138

SHA256
48d6736704ff02e02fa1cd04556d86c01a3c5ac2f972f43cb62e9cf084322100

SHA512
e74a614c4583bb662486abe9ad2eab0ad22014938528d8abc66e46a8c75f6cf241ff6a000fe48bb205556ed535d61ae160a1a4e6884588857843310d83d7a905

Download Submit
memory/1656-33-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/1656-0-0x00000000009C0000-0x0000000000A72000-memory.dmp

Filesize
712KB

Download
memory/1656-3-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download
memory/1656-5-0x0000000005260000-0x00000000052E2000-memory.dmp

Filesize
520KB

Download
memory/1656-2-0x0000000004D90000-0x0000000004DD0000-memory.dmp

Filesize
256KB

Download
memory/1656-1-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/1656-4-0x0000000000650000-0x000000000065C000-memory.dmp

Filesize
48KB

Download
memory/2396-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2396-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2396-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2396-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2396-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2396-40-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2396-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2396-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2396-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2396-34-0x0000000074810000-0x0000000074EFE000-memory.dmp

Filesize
6.9MB

Download
memory/2492-21-0x000000006F6A0000-0x000000006FC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2492-35-0x0000000002160000-0x00000000021A0000-memory.dmp

Filesize
256KB

Download
memory/2492-37-0x0000000002160000-0x00000000021A0000-memory.dmp

Filesize
256KB

Download
memory/2492-39-0x000000006F6A0000-0x000000006FC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2492-18-0x000000006F6A0000-0x000000006FC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-20-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2608-19-0x000000006F6A0000-0x000000006FC4B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-36-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2608-38-0x000000006F6A0000-0x000000006FC4B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads