agenttesla | 13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4

General

Target

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe
Size

687KB
MD5

34e65ca275e94eb01fa9bff73b1a4f99
SHA1

243e7e34ada4e5993c836980e899664a85eaa14b
SHA256

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4
SHA512

1021a5d4f04330b68a15c20427c510ae7c2960e70eb6b40050415bcb8e7f99576cd4264555c7ee879341c9451ea1eeeab56db3c157f73805a9585e1e5aaad9ed
SSDEEP

12288:ig0YOwq+phFjZyzFXvQnUpo0ddzpYIkNbKGQx6GqLBjLH1MtlWlmRvWzfwI:JO7e8F/7NjKIkNbKGwr6WtglWvWD

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.satsllc.ae
Port:
587
Username:
[email protected]
Password:
Ahsan@12345
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-15-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2796-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2796-19-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2796-21-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2796-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2996-26-0x0000000000740000-0x0000000000780000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-15-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2796-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2796-19-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2796-21-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2796-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2996-26-0x0000000000740000-0x0000000000780000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with SmartAssembly 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2784-4-0x0000000000650000-0x000000000065C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing Windows vault credential objects. Observed in infostealers 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-15-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2796-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2796-19-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2796-21-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2796-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2996-26-0x0000000000740000-0x0000000000780000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-15-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2796-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2796-19-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2796-21-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2796-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2996-26-0x0000000000740000-0x0000000000780000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-15-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2796-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2796-19-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2796-21-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2796-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2996-26-0x0000000000740000-0x0000000000780000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2796-15-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2796-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2796-19-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2796-21-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2796-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2996-26-0x0000000000740000-0x0000000000780000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe

description	pid	process	target process
PID 2784 set thread context of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2536 schtasks.exe

pid	process
2536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exeRegSvcs.exepowershell.exe

pid	process
2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe
2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe
2796	RegSvcs.exe
2796	RegSvcs.exe
2996	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exeRegSvcs.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe
Token: SeDebugPrivilege	2796	RegSvcs.exe
Token: SeDebugPrivilege	2996	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe

description	pid	process	target process
PID 2784 wrote to memory of 2996	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	powershell.exe
PID 2784 wrote to memory of 2996	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	powershell.exe
PID 2784 wrote to memory of 2996	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	powershell.exe
PID 2784 wrote to memory of 2996	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	powershell.exe
PID 2784 wrote to memory of 2536	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	schtasks.exe
PID 2784 wrote to memory of 2536	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	schtasks.exe
PID 2784 wrote to memory of 2536	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	schtasks.exe
PID 2784 wrote to memory of 2536	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	schtasks.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe
PID 2784 wrote to memory of 2796	2784	13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe
"C:\Users\Admin\AppData\Local\Temp\13c8ddb6f93accdd2ecf3725d709b438fe1eeb3637e42a2df7e141ec339287b4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zsHSBdyxHEzyp.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zsHSBdyxHEzyp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4125.tmp"
2⤵
- Creates scheduled task(s)
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4125.tmp
Filesize
1KB

MD5
b51054ed56f333af7edfcd64c1150f64

SHA1
f2179ebf5304e1ed344cc68392b3a1f89262f6e2

SHA256
240a57fd71f9625fbf79730db7c471c738ccedea7cd7190a79beb1f6f02da28b

SHA512
6ecaecb26946d2059814bcad530da1bab7db58334a6c46f3c2767b78bf65705a2e618dfea89cb1b33d9ea50bd6b4d163209e5d962321f3361a46bec6824227b8

Download Submit
memory/2784-1-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2784-0-0x0000000000090000-0x0000000000142000-memory.dmp

Filesize
712KB

Download
memory/2784-2-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/2784-3-0x00000000003A0000-0x00000000003BA000-memory.dmp

Filesize
104KB

Download
memory/2784-4-0x0000000000650000-0x000000000065C000-memory.dmp

Filesize
48KB

Download
memory/2784-5-0x00000000053B0000-0x0000000005432000-memory.dmp

Filesize
520KB

Download
memory/2784-23-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2796-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-29-0x0000000004890000-0x00000000048D0000-memory.dmp

Filesize
256KB

Download
memory/2796-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2796-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2796-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2796-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2796-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2796-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2796-33-0x0000000004890000-0x00000000048D0000-memory.dmp

Filesize
256KB

Download
memory/2796-32-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2796-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2796-28-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2996-30-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/2996-27-0x000000006E730000-0x000000006ECDB000-memory.dmp

Filesize
5.7MB

Download
memory/2996-31-0x000000006E730000-0x000000006ECDB000-memory.dmp

Filesize
5.7MB

Download
memory/2996-26-0x0000000000740000-0x0000000000780000-memory.dmp

Filesize
256KB

Download
memory/2996-25-0x000000006E730000-0x000000006ECDB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads