agenttesla | 7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4

General

Target

7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
Size

744KB
MD5

6aa3cad2e92e967768780540a1a78432
SHA1

22e6e450889c383af12b571b8e9d83eb9f33c36d
SHA256

7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4
SHA512

f71bfd535b86391ebd8aa72e4eb1e650e33ca5a1b1ff4740de2589c6896d6c2fd70064d7fcb1a8a4ff7f5826566000ee190766121ff96b4db2ffbea27d8a031e
SSDEEP

12288:Gz9n6yWn7fcpVZlu/6uHGedT2shwb201O2nVfW9HjoaN37+2rAfraVDUBWpHfMdg:cn698VVYrH0/RW9HsaNFcouWpHh88

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://eu-west-1.sftpcloud.io
Port:
21
Username:
e8a17a253c4d40b6a0df898aad32f67b
Password:
RugFalv5wDyjeLFrWC25Q2kWCAS6XObb

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

3044 powershell.exe
2696 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3044	powershell.exe
2696	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe

description	pid	process	target process
PID 1644 set thread context of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2868 schtasks.exe

pid	process
2868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exepowershell.exepowershell.exe

pid	process
1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
2660	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
2660	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
2696	powershell.exe
3044	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
Token: SeDebugPrivilege	2660	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe

description	pid	process	target process
PID 1644 wrote to memory of 3044	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 3044	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 3044	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 3044	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 2696	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 2696	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 2696	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 2696	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	powershell.exe
PID 1644 wrote to memory of 2868	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	schtasks.exe
PID 1644 wrote to memory of 2868	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	schtasks.exe
PID 1644 wrote to memory of 2868	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	schtasks.exe
PID 1644 wrote to memory of 2868	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	schtasks.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
PID 1644 wrote to memory of 2660	1644	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe	7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe

C:\Users\Admin\AppData\Local\Temp\7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
"C:\Users\Admin\AppData\Local\Temp\7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cRoYbaFHyBg.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cRoYbaFHyBg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F01.tmp"
2⤵
- Creates scheduled task(s)
PID:2868

C:\Users\Admin\AppData\Local\Temp\7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe
"C:\Users\Admin\AppData\Local\Temp\7f9a4d2ca7e2aaaf846b8c8be5b13945fbd3ed02e75ea661676b311897e92fa4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

2

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5F01.tmp
Filesize
1KB

MD5
f8825dda04b5c06d89e2e9022a7c1e2d

SHA1
fe57760b44d49ebe34edc467f19a93ef9cec354a

SHA256
a0ff0f1fff810d957c9290d01d287a2a2bc30cac373f7124ec10846cbbbcc05d

SHA512
e2d287fe95baabc79cad3e5f7139b1ff6d58c938505fb7598863592d1571fd397fb78c9521bacb7bafd1c9d4c1ffe5adbb7504ee561ae8d00762d81f976695cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
a4ddde5df0f61acab915788de20a8d13

SHA1
710d8ab85013c1729abb2cb214f839abf1882da7

SHA256
f150418f6a0a4eadb8e4411d49e55a873e20c294145ba730a59697ef9dac699c

SHA512
93658c74d6aaef8e101c53a53fe9c25b795982102f5ea251901167f8fff41070c9842f67c603524f3a3b9daf1df8a4651f59869db23e9d21e994c16e24717093

Download Submit
memory/1644-4-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/1644-31-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1644-0-0x000000007476E000-0x000000007476F000-memory.dmp

Filesize
4KB

Download
memory/1644-5-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/1644-6-0x0000000004EF0000-0x0000000004F72000-memory.dmp

Filesize
520KB

Download
memory/1644-2-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1644-1-0x0000000000930000-0x00000000009EE000-memory.dmp

Filesize
760KB

Download
memory/1644-3-0x0000000000690000-0x00000000006B2000-memory.dmp

Filesize
136KB

Download
memory/2660-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2660-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2660-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2660-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2660-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2660-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2660-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads