agenttesla | 57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff

General

Target

57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe
Size

708KB
MD5

4aada6a3437c090cc6eaccff1e2461a8
SHA1

2fa61668df7007b177e53b49f66a4b6402dc198a
SHA256

57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff
SHA512

13c267ba8c066603646a0a8f3f9e64da9d45780f1721790672e46cac0fa5a6de3bff2ead3ec78be4126ca8ed55d0019889819502f15f20b81d900cc5f3521643
SSDEEP

12288:/xgbES42ZMifA7nGvxt2yiAOp9rLj8JbSUBKN4l3hCDbS3KXUYMjhvPie/rByY7E:/xgQ0An2t2ygXj86CybZUYMFniyyrL

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mayedasselectromech.com
Port:
587
Username:
[email protected]
Password:
India@2014
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

resource	yara_rule
behavioral1/memory/2568-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2568-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2568-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2568-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2568-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

resource	yara_rule
behavioral1/memory/2568-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2568-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2568-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2568-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2568-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

resource	yara_rule
behavioral1/memory/2568-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2568-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2568-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2568-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2568-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2568-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2568-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2568-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2568-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2568-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2568-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2568-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2568-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2568-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2568-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2568-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2568-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2568-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2568-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2568-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2536	powershell.exe
2676	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe
2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe
2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe
2568	RegSvcs.exe
2568	RegSvcs.exe
2676	powershell.exe
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe
Token: SeDebugPrivilege	2568	RegSvcs.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2536	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	28
PID 2204 wrote to memory of 2536	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	28
PID 2204 wrote to memory of 2536	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	28
PID 2204 wrote to memory of 2536	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	28
PID 2204 wrote to memory of 2676	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	30
PID 2204 wrote to memory of 2676	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	30
PID 2204 wrote to memory of 2676	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	30
PID 2204 wrote to memory of 2676	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	30
PID 2204 wrote to memory of 2548	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	31
PID 2204 wrote to memory of 2548	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	31
PID 2204 wrote to memory of 2548	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	31
PID 2204 wrote to memory of 2548	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	31
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34
PID 2204 wrote to memory of 2568	2204	57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe	34

C:\Users\Admin\AppData\Local\Temp\57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe
"C:\Users\Admin\AppData\Local\Temp\57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\57b9c02fbb21761c2311e2a4d15f8b92654c63198cbff8ada952bac82c7c99ff.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SBOAkVoX.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SBOAkVoX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4347.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4347.tmp

Filesize
1KB

MD5
bc19537f9cab3f8a74071a92f024299a

SHA1
e4cd1c43bbdeb3d2e9a81c6d037d401bed7ead0e

SHA256
58808a1feb098aa624d512d8be10712cb2db3c1a452e0596eca09158238d500b

SHA512
e622100d26a393103c2a2eabd390c54277dd6b2969204bafb383ac937db1ab5b89f41b654cd29588f515bad002955016056d1e5f701c10f7f7e6d7f31dcda0c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
d06b3d707e826bdc4cddbb141b5d5040

SHA1
4ab355d1388ebbd2376a2dbadef5a5d1a1fffd9d

SHA256
b1ab98c2dc5431cad1fd425ed3de64e1f54188f056477370c50ee0981e51e1ea

SHA512
334ccfcd80359a7f72b8425f3b02583b054643cf74cb5428c5915ccf3f1023124ab874aa8de8af3b5a0e51f2d9e1d0a8cf41af03e9b9cc7b938bd2f3dd33ad29

Download Submit
memory/2204-4-0x0000000001F60000-0x0000000001F70000-memory.dmp

Filesize
64KB

Download
memory/2204-31-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-0-0x00000000747BE000-0x00000000747BF000-memory.dmp

Filesize
4KB

Download
memory/2204-5-0x0000000001F70000-0x0000000001F86000-memory.dmp

Filesize
88KB

Download
memory/2204-6-0x0000000004EB0000-0x0000000004F32000-memory.dmp

Filesize
520KB

Download
memory/2204-3-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-1-0x0000000000100000-0x00000000001B4000-memory.dmp

Filesize
720KB

Download
memory/2204-2-0x0000000000740000-0x0000000000760000-memory.dmp

Filesize
128KB

Download
memory/2568-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2568-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2568-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads