agenttesla | f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5

General

Target

f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
Size

1.0MB
MD5

9b8544c46d581622f7d13513c90960d7
SHA1

ab8f26ade5e500fa6b0ad95cf526ef0d163bee04
SHA256

f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5
SHA512

752b3de1874cac45dd3317fba21260638af77ae0d0d655a787178a798c8ffdaf221ea24963de213912ea6b102d782dc050fdbf54923d190bd5b9e8d1ec6e485d
SSDEEP

24576:MzsxWtb3BEvGdb3AQfGZ3TI53jWVeCMSpSpmax:M5ZBEed1Y3kqVeCMeTax

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.skitz.com.ng
Port:
21
Username:
[email protected]
Password:
Kosyano1@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2404 powershell.exe
2620 powershell.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
2404	powershell.exe
2620	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vbc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\hWgMNz = "C:\\Users\\Admin\\AppData\\Roaming\\hWgMNz\\hWgMNz.exe"	vbc.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
6 ip-api.com

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe

description	pid	process	target process
PID 2872 set thread context of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2560 schtasks.exe

pid	process
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exepowershell.exepowershell.exevbc.exe

pid	process
2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
2404	powershell.exe
2620	powershell.exe
2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
2444	vbc.exe
2444	vbc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exepowershell.exepowershell.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2444	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

2444 vbc.exe

pid	process
2444	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe

description	pid	process	target process
PID 2872 wrote to memory of 2620	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2620	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2620	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2620	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2404	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2404	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2404	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2404	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	powershell.exe
PID 2872 wrote to memory of 2560	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	schtasks.exe
PID 2872 wrote to memory of 2560	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	schtasks.exe
PID 2872 wrote to memory of 2560	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	schtasks.exe
PID 2872 wrote to memory of 2560	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	schtasks.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe
PID 2872 wrote to memory of 2444	2872	f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe
"C:\Users\Admin\AppData\Local\Temp\f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f872e441743cc9c85aa611b5060dd2d5b392adf20eae28ff57716a4a64dc96b5.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kcSwhKQEcnmk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kcSwhKQEcnmk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6190.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Scripting

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6190.tmp

Filesize
1KB

MD5
d4d14ebb903f71cc39382b114a165c7b

SHA1
9a5f40dfebacccf2a6a724940beed7d1c56485fb

SHA256
200bc7225852130e50244bec36070bc63f34a376d262f23a8cf9fdad3448f7dd

SHA512
1c73960954294ce89e044760a32c0c714372489b540a9efe2daf160ebe8ea423407054d3e1c68b56da84b23fb7c199298e016d6adcb208d51e6d1793170e6768

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f903c946d8cfab3b5bd096f0e24d671e

SHA1
d17a713119d0b2e2b0b00ec842c577b1e1d2507c

SHA256
b66a039e93fdf25ded141634b1dc2478e3ca1851a71009f37bb218a12bfa8ff4

SHA512
5863a57e40fcf10e259d2ebe3d7b4fef0b88db21448ed5c957a4ce9931291837090ff860cf3c74f9611bfd22be6d5f554dcb6e9503972741e930c0a6571aadfc

Download Submit
memory/2444-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2444-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2444-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2444-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2444-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2444-27-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2444-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2444-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2872-6-0x0000000004510000-0x0000000004594000-memory.dmp

Filesize
528KB

Download
memory/2872-1-0x0000000000FC0000-0x00000000010C4000-memory.dmp

Filesize
1.0MB

Download
memory/2872-0-0x000000007461E000-0x000000007461F000-memory.dmp

Filesize
4KB

Download
memory/2872-2-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download
memory/2872-3-0x00000000002E0000-0x0000000000302000-memory.dmp

Filesize
136KB

Download
memory/2872-5-0x0000000000410000-0x0000000000420000-memory.dmp

Filesize
64KB

Download
memory/2872-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2872-32-0x0000000074610000-0x0000000074CFE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads