agenttesla | 76c307b3265b16a75c9aee4cd6fc81e70e81c173fafa43289172bc1c766d4817

General

Target

AWB.exe
Size

725KB
MD5

cd3754976ede221faea878084c12f20a
SHA1

5034bade13d439d013bd94bc856c29aba36ce3d3
SHA256

0dbd99dde1de7165ccde4c0b87b7c533fb79fb3c99e59356a23f74f939d7a32d
SHA512

31e10adde937c0f0131928c55bbfe96377c26d03bee8e17598fdbd818a859ebd2cb3e76ac9fe25c342732061774fb58a1086dcf9910da7e25225fe9addd0011e
SSDEEP

12288:WyW11Sh2iNw/yBLfbBMKkWudtyH62otT3nV431hP7kH0tiYR9yqg2aVmADYZr1S:IDw1G/y5fbGKRud8H62otT3G1hgM3Ro2

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.shivomrealty.com
Port:
587
Username:
[email protected]
Password:
Priya1982#
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of SetThreadContext 1 IoCs

Processes:

AWB.exe

description pid process target process

PID 1368 set thread context of 2536 1368 AWB.exe AWB.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2584 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

AWB.exeAWB.exepowershell.exepowershell.exe

pid process

1368 AWB.exe
1368 AWB.exe
1368 AWB.exe
2536 AWB.exe
2536 AWB.exe
3036 powershell.exe
2156 powershell.exe

description	pid	process	target process
PID 1368 set thread context of 2536	1368	AWB.exe	AWB.exe

pid	process
2584	schtasks.exe

pid	process
1368	AWB.exe
1368	AWB.exe
1368	AWB.exe
2536	AWB.exe
2536	AWB.exe
3036	powershell.exe
2156	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AWB.exeAWB.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1368	AWB.exe
Token: SeDebugPrivilege	2536	AWB.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

AWB.exe

description	pid	process	target process
PID 1368 wrote to memory of 3036	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 3036	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 3036	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 3036	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 2156	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 2156	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 2156	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 2156	1368	AWB.exe	powershell.exe
PID 1368 wrote to memory of 2584	1368	AWB.exe	schtasks.exe
PID 1368 wrote to memory of 2584	1368	AWB.exe	schtasks.exe
PID 1368 wrote to memory of 2584	1368	AWB.exe	schtasks.exe
PID 1368 wrote to memory of 2584	1368	AWB.exe	schtasks.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe
PID 1368 wrote to memory of 2536	1368	AWB.exe	AWB.exe

C:\Users\Admin\AppData\Local\Temp\AWB.exe
"C:\Users\Admin\AppData\Local\Temp\AWB.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AWB.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GlBpyj.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GlBpyj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp40A8.tmp"
2⤵
- Creates scheduled task(s)
PID:2584

C:\Users\Admin\AppData\Local\Temp\AWB.exe
"C:\Users\Admin\AppData\Local\Temp\AWB.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp40A8.tmp
Filesize
1KB

MD5
c0040fc047d95210cc8b665bdd5943b0

SHA1
8e42169065dffcf3dd1a5b82556256b20effb58f

SHA256
91d6d6317e6579751c8adf34b10acc26858ffac07fd245da829ab639b2888b0e

SHA512
d00654668facd8b3e535b70d17474f33496741acef1d3daaf19d0e17ee459af0726963ff47ae6dc7e21103ce4ae73dd16d86a2319726ac3a0e43e8ddaba745c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
a9de31a895bdec738377923b5699d8dd

SHA1
812c497cf2743950e367e77c8a74a7e0602a88ef

SHA256
8c75fdc6536aa76e5018a274f61625e61584d99639105bb0de8771c984922421

SHA512
caa9d8244e95acd4d56224a0bce40f99e3e2ac035a58a3b2cc21025eb9e52deced9fc495d91e1472a4f5d8d0ba927a9bf7d6308fc10a33294dcf23cf363eeae4

Download Submit
memory/1368-3-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/1368-0-0x00000000013B0000-0x000000000146A000-memory.dmp

Filesize
744KB

Download
memory/1368-4-0x0000000000730000-0x000000000073C000-memory.dmp

Filesize
48KB

Download
memory/1368-5-0x0000000005D60000-0x0000000005DE2000-memory.dmp

Filesize
520KB

Download
memory/1368-2-0x0000000004B50000-0x0000000004B90000-memory.dmp

Filesize
256KB

Download
memory/1368-1-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/1368-33-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-43-0x000000006E2C0000-0x000000006E86B000-memory.dmp

Filesize
5.7MB

Download
memory/2156-37-0x000000006E2C0000-0x000000006E86B000-memory.dmp

Filesize
5.7MB

Download
memory/2156-39-0x0000000002960000-0x00000000029A0000-memory.dmp

Filesize
256KB

Download
memory/2156-34-0x000000006E2C0000-0x000000006E86B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2536-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-46-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-45-0x00000000012C0000-0x0000000001300000-memory.dmp

Filesize
256KB

Download
memory/2536-40-0x00000000012C0000-0x0000000001300000-memory.dmp

Filesize
256KB

Download
memory/2536-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-41-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/3036-35-0x000000006E2C0000-0x000000006E86B000-memory.dmp

Filesize
5.7MB

Download
memory/3036-44-0x000000006E2C0000-0x000000006E86B000-memory.dmp

Filesize
5.7MB

Download
memory/3036-42-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/3036-38-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/3036-36-0x000000006E2C0000-0x000000006E86B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads