agenttesla | 431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee

General

Target

431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
Size

797KB
MD5

d622b8ebbfac5db213c53dd40c49e7d7
SHA1

a17d31f3690971604c3edce1ebab4613fcb8bd88
SHA256

431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee
SHA512

c5b4c4d85db33d87b67d2bfa9fb1c3cb96ea8863efa4a581a639cffd86487f8a50f1459ce8205c4b79fbf372a1eb2554596b16627d92fd3217380cf0c2aad898
SSDEEP

12288:qIJWET/mr9K+22BEEzFatnTa3x0ld2n8Iec0uwFVkKKgtGmEGoYmjCc06b7xtVli:VWtb3BEdv/2nxec0uwDkK0IoYSq

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
premium162.web-hosting.com
Port:
587
Username:
[email protected]
Password:
Look@oursuccess247
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2940 powershell.exe
2984 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com

pid	process
2940	powershell.exe
2984	powershell.exe

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe

description	pid	process	target process
PID 2204 set thread context of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2596 schtasks.exe

pid	process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exepowershell.exepowershell.exe

pid	process
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
1356	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
1356	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
2940	powershell.exe
2984	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
Token: SeDebugPrivilege	1356	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe

pid process

1356 431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe

pid	process
1356	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe

description	pid	process	target process
PID 2204 wrote to memory of 2984	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2984	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2984	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2984	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2940	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2940	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2940	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2940	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	powershell.exe
PID 2204 wrote to memory of 2596	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	schtasks.exe
PID 2204 wrote to memory of 2596	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	schtasks.exe
PID 2204 wrote to memory of 2596	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	schtasks.exe
PID 2204 wrote to memory of 2596	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	schtasks.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
PID 2204 wrote to memory of 1356	2204	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe	431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe

C:\Users\Admin\AppData\Local\Temp\431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
"C:\Users\Admin\AppData\Local\Temp\431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qDfIBEcYE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qDfIBEcYE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDF9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe
  "C:\Users\Admin\AppData\Local\Temp\431d88693bfa9779b1ee70c50c74ef961ae9a96d1fb50f6e2bc203a3bd2852ee.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCDF9.tmp

Filesize
1KB

MD5
76b316a1aad2eac0dd8b412955c248ad

SHA1
191dd93ae43ee246d3e5374dfa6bf5bb685706c6

SHA256
ccc42319201a2491180ef0225b87be008bf28e19fffb731afb49f0e1622db1cf

SHA512
4b7bcf90099ca48e2e060dd46d3b401cd8536e25b34bce63a9613df4daaff19470d1cb57c6bc577559277688992175283b9ce6466b7b567a950e76e51b69a8f3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
4c2052a2acccf7db1171701e084e39d5

SHA1
de2bb547021fad9cb568dbb1817372a27a277a1b

SHA256
00b2dfbe8f4690d91b674c2772cf3754defe383f329b14a5d6922ab08575ba8b

SHA512
d4b534d560fe002497707334d9eb96aec33c8f63b38b85ed4bc718b79569ae29c35198d01bed0309680e216dd69b4f4e84aa3f2f0585ab171c461f38424e887e

Download Submit
memory/1356-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1356-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1356-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1356-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1356-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1356-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1356-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1356-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2204-7-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2204-1-0x00000000012A0000-0x000000000136A000-memory.dmp

Filesize
808KB

Download
memory/2204-2-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2204-8-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2204-3-0x0000000000A40000-0x0000000000A62000-memory.dmp

Filesize
136KB

Download
memory/2204-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2204-33-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2204-6-0x0000000005D80000-0x0000000005E04000-memory.dmp

Filesize
528KB

Download
memory/2204-5-0x00000000007E0000-0x00000000007F0000-memory.dmp

Filesize
64KB

Download
memory/2204-4-0x00000000008F0000-0x00000000008FC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads