agenttesla | 9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a

General

Target

9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
Size

776KB
MD5

5f9d4ff4aefc50027743838e9c241712
SHA1

bb3b3d8997ff5ece674edf403a08f34135552161
SHA256

9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a
SHA512

43e45fe492cb7831742afd5022f9f080d2681c74ba104d829bafaf3ee045cf51f9e5920c89e2a7851ac5478ee4ea3b61befd3e474cf43281f0d2f333c6893ba3
SSDEEP

12288:BMLK1CkY1mCZBHyBxHiwjhaDdDrdlgrdvk0V4TdRq5U:CiCb1mCZBy3iFDtrdla+IEdRq5U

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.daiwalmi.com
Port:
587
Username:
[email protected]
Password:
YIxs6.PYofyf
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

description	pid	process	target process
PID 2932 set thread context of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2608 schtasks.exe

pid	process
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exepowershell.exepowershell.exe9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

pid	process
2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
2292	powershell.exe
2712	powershell.exe
2452	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
2452	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exepowershell.exepowershell.exe9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

description	pid	process
Token: SeDebugPrivilege	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2452	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

description	pid	process	target process
PID 2932 wrote to memory of 2292	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2292	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2292	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2292	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2712	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2712	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2712	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2712	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	powershell.exe
PID 2932 wrote to memory of 2608	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	schtasks.exe
PID 2932 wrote to memory of 2608	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	schtasks.exe
PID 2932 wrote to memory of 2608	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	schtasks.exe
PID 2932 wrote to memory of 2608	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	schtasks.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
PID 2932 wrote to memory of 2452	2932	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe	9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe

C:\Users\Admin\AppData\Local\Temp\9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
"C:\Users\Admin\AppData\Local\Temp\9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QJVOQW.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QJVOQW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp387E.tmp"
2⤵
- Creates scheduled task(s)
PID:2608

C:\Users\Admin\AppData\Local\Temp\9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe
"C:\Users\Admin\AppData\Local\Temp\9d1852dfe875e0eae7b36a5ff10b21dab88d432ccd61caa2be3b517ae9c4d94a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp387E.tmp

Filesize
1KB

MD5
40205c16ce47befc2fd6646f63b08b0d

SHA1
5eca81cb2b89b79fdc80524dcc467b46e767fbdc

SHA256
42e25ec531ae965ce31177e0446aa48f52c021decad59eec39e083fe49ffde2d

SHA512
5b5e61c3c0adc29b10c6add8edf1aa5ea5a72ebef8d6c50b228e823a67f0b9d9fe85978d4f5e40492635f1df75989156f6831cafeee7bac9b636cfc3b6281e8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZS8QXU6H7YBMOYB77J3B.temp

Filesize
7KB

MD5
ea7b5a4206dc1bab04b338ce343726e5

SHA1
7385377f47a4f68f4c957d5aaaf68b275d9af61a

SHA256
5a0925f2745d022ff77feaffef7b20c64f6e8b5f18517c1367147009154e7193

SHA512
8ba6b378f62428a1d2dcb6c3facb448e6dd19b903c29a195a4e3010d0c0dae9da92cf6af77179718395af9f14bad8664b94ac8d87a0c443b35023088686a4d8e

Download Submit
memory/2292-32-0x000000006F580000-0x000000006FB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-37-0x000000006F580000-0x000000006FB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-34-0x0000000002B20000-0x0000000002B60000-memory.dmp

Filesize
256KB

Download
memory/2452-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2452-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2452-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2452-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2452-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2452-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2452-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2452-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2712-31-0x000000006F580000-0x000000006FB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2712-33-0x0000000002B00000-0x0000000002B40000-memory.dmp

Filesize
256KB

Download
memory/2712-35-0x000000006F580000-0x000000006FB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2712-36-0x0000000002B00000-0x0000000002B40000-memory.dmp

Filesize
256KB

Download
memory/2712-38-0x000000006F580000-0x000000006FB2B000-memory.dmp

Filesize
5.7MB

Download
memory/2932-5-0x00000000053B0000-0x0000000005434000-memory.dmp

Filesize
528KB

Download
memory/2932-2-0x0000000004A50000-0x0000000004A90000-memory.dmp

Filesize
256KB

Download
memory/2932-4-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2932-30-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download
memory/2932-0-0x0000000000EA0000-0x0000000000F62000-memory.dmp

Filesize
776KB

Download
memory/2932-3-0x0000000000690000-0x00000000006AA000-memory.dmp

Filesize
104KB

Download
memory/2932-1-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads