agenttesla | 43c14d25c429673a9500c057417959c014bdcd77513109d529b62277dc4e0b94

General

Target

xprosperzx.exe
Size

765KB
MD5

9d74667db0f138f0943851bf3e0bbd0a
SHA1

fe62846aee811b2ec87b2ea05309a944e314df11
SHA256

43c14d25c429673a9500c057417959c014bdcd77513109d529b62277dc4e0b94
SHA512

b306bc2c5761da2cca33b5c9eff238744651ec70896bcc16975efdbb660cdbbd8fb74ea472612da40f55fb2c34f73f596c2116c4b453f6d889b561a3eb50efbe
SSDEEP

12288:5UtNBeBN2xpkZ/SlGtutycVRmPLOd2sLBkVroJwCHj2ypNWJRu/kR:6tNm2xp9ItutxRm42sCVrxCD2ypNWHT

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
7213575aceACE@#
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1768 set thread context of 2288	1768	xprosperzx.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1768	xprosperzx.exe
1768	xprosperzx.exe
2288	xprosperzx.exe
2288	xprosperzx.exe
2596	powershell.exe
2396	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1768	xprosperzx.exe
Token: SeDebugPrivilege	2288	xprosperzx.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2396	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2396	1768	xprosperzx.exe	28
PID 1768 wrote to memory of 2396	1768	xprosperzx.exe	28
PID 1768 wrote to memory of 2396	1768	xprosperzx.exe	28
PID 1768 wrote to memory of 2396	1768	xprosperzx.exe	28
PID 1768 wrote to memory of 2596	1768	xprosperzx.exe	30
PID 1768 wrote to memory of 2596	1768	xprosperzx.exe	30
PID 1768 wrote to memory of 2596	1768	xprosperzx.exe	30
PID 1768 wrote to memory of 2596	1768	xprosperzx.exe	30
PID 1768 wrote to memory of 2580	1768	xprosperzx.exe	32
PID 1768 wrote to memory of 2580	1768	xprosperzx.exe	32
PID 1768 wrote to memory of 2580	1768	xprosperzx.exe	32
PID 1768 wrote to memory of 2580	1768	xprosperzx.exe	32
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34
PID 1768 wrote to memory of 2288	1768	xprosperzx.exe	34

C:\Users\Admin\AppData\Local\Temp\xprosperzx.exe
"C:\Users\Admin\AppData\Local\Temp\xprosperzx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\xprosperzx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YPSYrrFqkJQmSN.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YPSYrrFqkJQmSN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7262.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2580
- C:\Users\Admin\AppData\Local\Temp\xprosperzx.exe
  "C:\Users\Admin\AppData\Local\Temp\xprosperzx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7262.tmp

Filesize
1KB

MD5
dad7df21d6aa28ea84ef6abfee9c4f11

SHA1
0ce75e7c9e86c7293df7da304f786cd98d2e5d90

SHA256
4b58d8a62e65e38ca7473ad2f198d49cc657b35e1b8e6a8456e0ce6247e5b323

SHA512
b9186ee60a5a1ed2893b67a87af7d8eedd2c25f7f3a2c40dc18812a71037fad1c6699d2a9a7f539d07dcb373b538095d08f1d7ff5ef82a33cf948ce9d0c2b525

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
17440c260ec338fdddf19c55df2c5ae1

SHA1
0c066f0aee12a8b4e38f6f688c33a569c44c80c0

SHA256
c348146093019d923ac1da600f544b76e2acef7cda3b2a7edfd9b892eabdc9bf

SHA512
780a1517dbf91cc7e5d0011348446008d053bbfe24b3ef0877952af885fb8ede3cca70903bf85ada17e83216fabd15d5828e52d34924aea63792b41913c62a95

Download Submit
memory/1768-0-0x0000000000300000-0x00000000003C2000-memory.dmp

Filesize
776KB

Download
memory/1768-1-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download
memory/1768-2-0x0000000004D10000-0x0000000004D50000-memory.dmp

Filesize
256KB

Download
memory/1768-3-0x0000000000540000-0x0000000000552000-memory.dmp

Filesize
72KB

Download
memory/1768-4-0x00000000005A0000-0x00000000005A8000-memory.dmp

Filesize
32KB

Download
memory/1768-5-0x00000000007F0000-0x00000000007FC000-memory.dmp

Filesize
48KB

Download
memory/1768-6-0x0000000005C80000-0x0000000005D02000-memory.dmp

Filesize
520KB

Download
memory/1768-30-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download
memory/2288-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-43-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download
memory/2288-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2288-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-36-0x0000000074DB0000-0x000000007549E000-memory.dmp

Filesize
6.9MB

Download
memory/2288-42-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/2288-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2288-34-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/2396-32-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Filesize
5.7MB

Download
memory/2396-39-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Filesize
5.7MB

Download
memory/2396-40-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Filesize
5.7MB

Download
memory/2596-33-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2596-38-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2596-37-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2596-41-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Filesize
5.7MB

Download
memory/2596-35-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Filesize
5.7MB

Download
memory/2596-31-0x000000006EDE0000-0x000000006F38B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads