agenttesla | 922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef

General

Target

922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
Size

728KB
MD5

339649aa12a77cfcc09c7b07fc9d7f52
SHA1

038ef4d52e2553340063d713660a1c4aa1fb7619
SHA256

922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef
SHA512

c329d09e06adf39e27ea380ada1913ecf3ef4211c3edcd1f3c1515f55fc0e9360e256efe7f1adc57852e56905e0376b61c87151e543bf8461e2e12c5d52196c2
SSDEEP

12288:3JglQx+3ZRl5RY4btD+K5t7UQC4u88ildNMPbUrpOwD4muneIjRxmL87vWX1pfSf:ZpxQRhtV88dgbUdOwTunGL8j15ya0M

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.itresinc.com
Port:
587
Username:
investorwithkarlee@itresinc.com
Password:
MT]ANFjWzKTA
Email To:
obtxxxtf@gmail.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2656-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2656-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2656-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2656-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2656-32-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2656-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2656-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2656-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2656-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2656-32-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2168-4-0x00000000007A0000-0x00000000007AC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2656-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2656-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2656-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2656-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2656-32-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2656-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2656-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2656-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2656-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2656-32-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2656-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2656-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2656-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2656-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2656-32-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2656-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2656-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2656-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2656-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2656-32-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe

description	pid	process	target process
PID 2168 set thread context of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2592 schtasks.exe

pid	process
2592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exepowershell.exepowershell.exe

pid	process
2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
2656	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
2656	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
2872	powershell.exe
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
Token: SeDebugPrivilege	2656	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe

description	pid	process	target process
PID 2168 wrote to memory of 2872	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2872	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2872	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2872	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2100	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2100	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2100	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2100	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	powershell.exe
PID 2168 wrote to memory of 2592	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	schtasks.exe
PID 2168 wrote to memory of 2592	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	schtasks.exe
PID 2168 wrote to memory of 2592	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	schtasks.exe
PID 2168 wrote to memory of 2592	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	schtasks.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
PID 2168 wrote to memory of 2656	2168	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe	922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe

C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
"C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TQUDbFDZarHZ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TQUDbFDZarHZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB71F.tmp"
2⤵
- Creates scheduled task(s)
PID:2592

C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe
"C:\Users\Admin\AppData\Local\Temp\922ed44d8e5c7526f172f18f7f2bcb352ae3c89295aa0b18448e6e18892ec4ef.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB71F.tmp
Filesize
1KB

MD5
9ce53597d91a11f556429f603dba7361

SHA1
088a7d69a4205076bf6aa2cea96eae1154f92ad1

SHA256
b50c5ee1d1e6db6428b1890f80cac356049e72333904310d35862a396a41df9e

SHA512
3e6b99ddd2c48ee0379dd279d1dfdef736a88a3896a56d51048738e4595ffcf76963b9c29ca42abd5d36161f1f287dbe26c65d37ad78cb86988b0b58dd3e9dd2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
4dadfc4c917af470459830b8480e6707

SHA1
285542597f784fb6bbe0c285e51534fa435320bf

SHA256
8e29a89b03ef52525af211bd7c799178966910a17e0cb4b0efff8f7f38406a4c

SHA512
a28a098be13e0d1027cf69c8e510d1ac160bce8a53d47d93889e623eae8db78e771fa00e7ad5a177d86403ae200ab5269d4f91c0cc6d98a5c52b360a6451d001

Download Submit
memory/2100-42-0x000000006CE70000-0x000000006D41B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-43-0x000000006CE70000-0x000000006D41B000-memory.dmp

Filesize
5.7MB

Download
memory/2100-37-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2100-35-0x000000006CE70000-0x000000006D41B000-memory.dmp

Filesize
5.7MB

Download
memory/2168-3-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/2168-4-0x00000000007A0000-0x00000000007AC000-memory.dmp

Filesize
48KB

Download
memory/2168-5-0x00000000051C0000-0x0000000005244000-memory.dmp

Filesize
528KB

Download
memory/2168-2-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2168-1-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-0-0x00000000011B0000-0x000000000126A000-memory.dmp

Filesize
744KB

Download
memory/2168-33-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-41-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2656-46-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/2656-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-45-0x0000000073EC0000-0x00000000745AE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2656-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2872-40-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2872-39-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2872-44-0x000000006CE70000-0x000000006D41B000-memory.dmp

Filesize
5.7MB

Download
memory/2872-38-0x000000006CE70000-0x000000006D41B000-memory.dmp

Filesize
5.7MB

Download
memory/2872-36-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2872-34-0x000000006CE70000-0x000000006D41B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads