agenttesla | 5dbddc716f4143d4197f3035bfcb71a00613b91dfc7208ba86f6ac54504d12ca

General

Target

L47fz5X2RSrsQIn.exe
Size

658KB
MD5

5313954569433d6b29f6b81862080ae8
SHA1

c113656034eed6c5c6ceaf247a20e002bee317f6
SHA256

fad66fe6b9c99e9b74fc56c06512b5d90a1296d15afba3cc356389524deb56f4
SHA512

db00b6329e45c709ac0bd13aecaec04c8d2593ab20f7fa67196aa67fb709055540e42bb1938fa36c143a2d56fd90ea0ebce953b8d1dbe1f0aa7114c24d0a2206
SSDEEP

12288:byzH2iNlw0m3JX7uJAaMOdUpzrrEwbczfnlU747hx7sG683NLoVS3cit:g1Xu34JjMpzrrEwbcDnlU7SnsaaO

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.magnatextile.com
Port:
587
Username:
[email protected]
Password:
ac%{*}mti{*}$es
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

L47fz5X2RSrsQIn.exe

description pid process target process

PID 2152 set thread context of 2480 2152 L47fz5X2RSrsQIn.exe L47fz5X2RSrsQIn.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2876 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

L47fz5X2RSrsQIn.exepowershell.exepowershell.exe

pid process

2480 L47fz5X2RSrsQIn.exe
2480 L47fz5X2RSrsQIn.exe
2624 powershell.exe
2620 powershell.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 2152 set thread context of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe

pid	process
2876	schtasks.exe

pid	process
2480	L47fz5X2RSrsQIn.exe
2480	L47fz5X2RSrsQIn.exe
2624	powershell.exe
2620	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

L47fz5X2RSrsQIn.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2480	L47fz5X2RSrsQIn.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

L47fz5X2RSrsQIn.exe

description	pid	process	target process
PID 2152 wrote to memory of 2620	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2620	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2620	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2620	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2624	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2624	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2624	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2624	2152	L47fz5X2RSrsQIn.exe	powershell.exe
PID 2152 wrote to memory of 2876	2152	L47fz5X2RSrsQIn.exe	schtasks.exe
PID 2152 wrote to memory of 2876	2152	L47fz5X2RSrsQIn.exe	schtasks.exe
PID 2152 wrote to memory of 2876	2152	L47fz5X2RSrsQIn.exe	schtasks.exe
PID 2152 wrote to memory of 2876	2152	L47fz5X2RSrsQIn.exe	schtasks.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe
PID 2152 wrote to memory of 2480	2152	L47fz5X2RSrsQIn.exe	L47fz5X2RSrsQIn.exe

C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe
"C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\exvGSYJA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\exvGSYJA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9981.tmp"
2⤵
- Creates scheduled task(s)
PID:2876

C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe
"C:\Users\Admin\AppData\Local\Temp\L47fz5X2RSrsQIn.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9981.tmp
Filesize
1KB

MD5
2f02297a0a5e3dd9870fd5a3f75dc267

SHA1
4b8d9e2986f0556a1046b53e925ac90a2b335d76

SHA256
9b114209cae9b52c832e50de06bed7dba5c0bc4356adc17d8e078452f8e97cca

SHA512
702f69cb4e2e332f021aa2f839c8b76e050e860def8dc19cabea727235a593042ee742c3b61902f766f63ed724267854d7b74d447da9451950e8a1aac02fde8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GMNI0W0L4DQG1R80BG6C.temp
Filesize
7KB

MD5
9618566642dbbc50f3fdfcb513864316

SHA1
f908a9aaae0e9479f6817656c7c9e4a670e55554

SHA256
11c688f27b6a88adb1d90e653869478832efb5e8d4ce9647c6ae6d6ecffbf257

SHA512
0940a22ce483225eab8a8de7ddf87fbd2b2672d761f3a2fdfd401dc3d6e2cdfbb793fbbf71c9901f454c971fdd353a90985d0df96577afd84e020dc8b08c76ae

Download Submit
memory/2152-26-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2152-3-0x0000000000490000-0x00000000004A2000-memory.dmp

Filesize
72KB

Download
memory/2152-2-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/2152-5-0x0000000004EF0000-0x0000000004F72000-memory.dmp

Filesize
520KB

Download
memory/2152-4-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/2152-1-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2152-0-0x0000000000C70000-0x0000000000D18000-memory.dmp

Filesize
672KB

Download
memory/2480-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2480-43-0x00000000047E0000-0x0000000004820000-memory.dmp

Filesize
256KB

Download
memory/2480-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-42-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/2480-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-35-0x0000000072F10000-0x00000000735FE000-memory.dmp

Filesize
6.9MB

Download
memory/2620-33-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download
memory/2620-34-0x000000006F240000-0x000000006F7EB000-memory.dmp

Filesize
5.7MB

Download
memory/2620-32-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download
memory/2620-36-0x0000000002500000-0x0000000002540000-memory.dmp

Filesize
256KB

Download
memory/2620-41-0x000000006F240000-0x000000006F7EB000-memory.dmp

Filesize
5.7MB

Download
memory/2620-30-0x000000006F240000-0x000000006F7EB000-memory.dmp

Filesize
5.7MB

Download
memory/2624-37-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/2624-38-0x0000000001FC0000-0x0000000002000000-memory.dmp

Filesize
256KB

Download
memory/2624-39-0x000000006F240000-0x000000006F7EB000-memory.dmp

Filesize
5.7MB

Download
memory/2624-40-0x000000006F240000-0x000000006F7EB000-memory.dmp

Filesize
5.7MB

Download
memory/2624-31-0x000000006F240000-0x000000006F7EB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads