agenttesla | 75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211

General

Target

75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
Size

831KB
MD5

46cfa299526c4b456ca0da04d70954dc
SHA1

9f66c851d80b921cce5f76533226e6d2d159d448
SHA256

75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211
SHA512

d0911768b699be59b73a931efcf52af7a5c771541b87425d5759ab63e17e79eb8d22849983affa3ec7abadb10aa488dd3e5479e089b31a0c0f25e83f4ccf74b1
SSDEEP

12288:VXH4jhk6ATS3fHfbpKU4ebexSQyD0DMCa7m:Su6AW3fHDpgOdAPaa

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://beirutrest.com
Port:
21
Username:
[email protected]
Password:
9yXQ39wz(uL+

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe

description	pid	process	target process
PID 2224 wrote to memory of 2516	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	powershell.exe
PID 2224 wrote to memory of 2516	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	powershell.exe
PID 2224 wrote to memory of 2516	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	powershell.exe
PID 2224 wrote to memory of 2516	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	powershell.exe
PID 2224 wrote to memory of 2564	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
PID 2224 wrote to memory of 2564	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
PID 2224 wrote to memory of 2564	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
PID 2224 wrote to memory of 2564	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
PID 2224 wrote to memory of 2564	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
PID 2224 wrote to memory of 2564	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
PID 2224 wrote to memory of 2564	2224	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe	75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe

C:\Users\Admin\AppData\Local\Temp\75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
"C:\Users\Admin\AppData\Local\Temp\75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe"
2⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe
"C:\Users\Admin\AppData\Local\Temp\75d92ad015f7ad1414f192fdb431baf93a6793c91f41ede63fb2b38ae632b211.exe"
2⤵
PID:2564

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-0-0x0000000000C00000-0x0000000000CD6000-memory.dmp

Filesize
856KB

Download
memory/2224-1-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2224-2-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2224-3-0x0000000000960000-0x0000000000978000-memory.dmp

Filesize
96KB

Download
memory/2224-4-0x0000000000980000-0x000000000098E000-memory.dmp

Filesize
56KB

Download
memory/2224-5-0x0000000000990000-0x00000000009A4000-memory.dmp

Filesize
80KB

Download
memory/2224-6-0x0000000004B20000-0x0000000004BAC000-memory.dmp

Filesize
560KB

Download
memory/2224-7-0x0000000005A90000-0x0000000005B12000-memory.dmp

Filesize
520KB

Download
memory/2224-21-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2224-18-0x0000000073F20000-0x000000007460E000-memory.dmp

Filesize
6.9MB

Download
memory/2516-16-0x000000006EE40000-0x000000006F3EB000-memory.dmp

Filesize
5.7MB

Download
memory/2516-17-0x000000006EE40000-0x000000006F3EB000-memory.dmp

Filesize
5.7MB

Download
memory/2516-19-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/2516-20-0x000000006EE40000-0x000000006F3EB000-memory.dmp

Filesize
5.7MB

Download
memory/2564-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing