agenttesla | 975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2

General

Target

975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
Size

1.0MB
MD5

1eb928b69e385c3d1390eb92a069360e
SHA1

f26bf21645c1f46a377db738ffd1a21adc2b6ec5
SHA256

975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2
SHA512

922794514e7d030e2b8011527bfe5796cfde3cc6f3070a09095f01fb6b8be55d95d9e7321da3add0075db5474aab3dc419390bfdd9c8280e7d00479356281f07
SSDEEP

24576:gMfw4bjw4b+hE+j86xgMEZw4UFhcyOWUNX+094+qwQE75:9w4bjw4bYo6xuChkPB+a4HwL

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
kosraepower.com
Port:
587
Username:
[email protected]
Password:
Noahmarijun16
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2904 powershell.exe
2728 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2904	powershell.exe
2728	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe

description	pid	process	target process
PID 2944 set thread context of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2600 schtasks.exe

pid	process
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exepowershell.exepowershell.exe

pid	process
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2448	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2448	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
2728	powershell.exe
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
Token: SeDebugPrivilege	2448	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe

description	pid	process	target process
PID 2944 wrote to memory of 2904	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2904	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2904	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2904	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2728	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2728	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2728	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2728	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	powershell.exe
PID 2944 wrote to memory of 2600	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	schtasks.exe
PID 2944 wrote to memory of 2600	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	schtasks.exe
PID 2944 wrote to memory of 2600	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	schtasks.exe
PID 2944 wrote to memory of 2600	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	schtasks.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
PID 2944 wrote to memory of 2448	2944	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe	975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe

C:\Users\Admin\AppData\Local\Temp\975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
"C:\Users\Admin\AppData\Local\Temp\975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iHAEjvt.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iHAEjvt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9869.tmp"
2⤵
- Creates scheduled task(s)
PID:2600

C:\Users\Admin\AppData\Local\Temp\975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe
"C:\Users\Admin\AppData\Local\Temp\975b6520ddcf9fc005dda2f8c077700c90fa13d5fff6f2c160b48b0b16c789c2.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9869.tmp

Filesize
1KB

MD5
22571a840f47725d37c0fc4629c1af37

SHA1
f8a4c27dbcf8095caeffcc1c2c473a61e16ff0e9

SHA256
7d5593705378874bc95a6e2ac02d0da91600730ff1d118ae16896e9119d7f016

SHA512
17fbe48798ffdf48b6c2891ead3410ea8a9af2fbe2509ef5f97b86f3e6fd2415346a66be5bfc6e0bd1579a868aa84864a52f0192794c6097179ecb9646e29b34

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MHL5DS8XQL6E6INSOZ1W.temp

Filesize
7KB

MD5
d0458bed920a62ebc1785ae41aa1be2d

SHA1
1db3f42785b328529fd7a4278232ba8588cf6cb2

SHA256
8684b8177a6b60be718d312e16ab73be850b7234bdf5fef4c99bfb9998a34d7e

SHA512
ca250750d394fed91b068da3476d5b22fd7a195a1c88ef51c44e507283de080a368c0fc07323fc1fdaf9e0254e54a955bfec595d6ae5d9fa2b05fddfb51d637b

Download Submit
memory/2448-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2944-1-0x00000000010D0000-0x00000000011D6000-memory.dmp

Filesize
1.0MB

Download
memory/2944-2-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2944-0-0x000000007462E000-0x000000007462F000-memory.dmp

Filesize
4KB

Download
memory/2944-7-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2944-6-0x000000007462E000-0x000000007462F000-memory.dmp

Filesize
4KB

Download
memory/2944-3-0x00000000009F0000-0x0000000000A0A000-memory.dmp

Filesize
104KB

Download
memory/2944-5-0x0000000007920000-0x00000000079A2000-memory.dmp

Filesize
520KB

Download
memory/2944-4-0x0000000000620000-0x0000000000630000-memory.dmp

Filesize
64KB

Download
memory/2944-32-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads