agenttesla | 530b019d1e22535451dbefd997a09c85eeeaa313b114c67ab67329d5fe14e8fc

General

Target

SOA.exe
Size

668KB
MD5

1b3feb610357e53c06656f8f084b7fe8
SHA1

135db2eecfdf9ec9f9a0a8ee5efe777e0f68437c
SHA256

530b019d1e22535451dbefd997a09c85eeeaa313b114c67ab67329d5fe14e8fc
SHA512

1773aceba4bcf0ac857a26240d63b0d700cd4a2d56e4984f3c9479653601ff737a438e97b7abc75c640c9a82665092a4d751968b9a90ac25b5f5cc6d86526ff8
SSDEEP

12288:24B778Q+A/y4Zz/LQglOYiZmxjIw3jbOFu5mQf0MiZA+tlEXF4xAKkR:PB1/LMYiZ884guyN3QXF4WJ

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.vpindustries.co.in
Port:
587
Username:
[email protected]
Password:
saleS*9988
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA.exe

description pid process target process

PID 1248 set thread context of 2496 1248 SOA.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2572 schtasks.exe

description	pid	process	target process
PID 1248 set thread context of 2496	1248	SOA.exe	RegSvcs.exe

pid	process
2572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

SOA.exeRegSvcs.exepowershell.exepowershell.exe

pid	process
1248	SOA.exe
1248	SOA.exe
1248	SOA.exe
1248	SOA.exe
1248	SOA.exe
1248	SOA.exe
1248	SOA.exe
2496	RegSvcs.exe
2496	RegSvcs.exe
2700	powershell.exe
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

SOA.exeRegSvcs.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1248	SOA.exe
Token: SeDebugPrivilege	2496	RegSvcs.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

SOA.exe

description	pid	process	target process
PID 1248 wrote to memory of 2700	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2700	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2700	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2700	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2600	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2600	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2600	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2600	1248	SOA.exe	powershell.exe
PID 1248 wrote to memory of 2572	1248	SOA.exe	schtasks.exe
PID 1248 wrote to memory of 2572	1248	SOA.exe	schtasks.exe
PID 1248 wrote to memory of 2572	1248	SOA.exe	schtasks.exe
PID 1248 wrote to memory of 2572	1248	SOA.exe	schtasks.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe
PID 1248 wrote to memory of 2496	1248	SOA.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RGziIWDEowC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RGziIWDEowC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6087.tmp"
2⤵
- Creates scheduled task(s)
PID:2572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2496

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6087.tmp
Filesize
1KB

MD5
9c11b74e48d2cf9fbbf6fac9f83e59c7

SHA1
f80871dd5c7d210562381edd30ea0ea68da0038c

SHA256
1fab9219c87c371ca04d34b3448ea9c462cde06355541a73e5a4a52af5bcc526

SHA512
13bbfb5e0d111e7523e4db454c5cb1a92b28e9b18d5be3ab87a3ecfdb6ade5044c081c1945c08958447b821797fecfe7a329c918cc346150b8117a9c179654f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
89932cbaa60cb389129662efd482419d

SHA1
ad2d4dee8f2071a6426fda1bcafa67ecb7788eba

SHA256
32ee9efea1610d28cd612e522210f4ceb32f212222b2d2b1453c9af7f3ec46a0

SHA512
bfbea725c5c842c9c50f41e381508dc25dec8c698cee4285439606524f782857c1954b5b00dc3a4de556f86ad1e35361d278468026c8d22f215908773637f41f

Download Submit
memory/1248-4-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/1248-31-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/1248-0-0x0000000001120000-0x00000000011CA000-memory.dmp

Filesize
680KB

Download
memory/1248-5-0x0000000000420000-0x0000000000436000-memory.dmp

Filesize
88KB

Download
memory/1248-6-0x00000000049B0000-0x0000000004A34000-memory.dmp

Filesize
528KB

Download
memory/1248-2-0x0000000004ED0000-0x0000000004F10000-memory.dmp

Filesize
256KB

Download
memory/1248-1-0x0000000074AA0000-0x000000007518E000-memory.dmp

Filesize
6.9MB

Download
memory/1248-3-0x00000000003F0000-0x0000000000408000-memory.dmp

Filesize
96KB

Download
memory/2496-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2496-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads