agenttesla | c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf

General

Target

c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
Size

853KB
MD5

a918e922397d50c75a2ae930e6e3e733
SHA1

f57c53de5e2b7156b7de7eb6fadac808db2a648f
SHA256

c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf
SHA512

b1d07be42ee7d6e412264828c99e7c25d4e027203272ae66ebb3fb9551fe777bccb0e0ddce8eb0b343e468a36b94b401af6e0be4e94601601471941b2a895683
SSDEEP

24576:Zw4bjw4blsqzA4+wKZjXU/GaHqK2RpnEU17B:Zw4bjw4blsqzgtU/dHqKEnEwB

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.springandsummer.lk
Port:
587
Username:
[email protected]
Password:
anu##323
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

resource	yara_rule
behavioral1/memory/2692-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2692-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2692-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2692-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2692-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

resource	yara_rule
behavioral1/memory/2692-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2692-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2692-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2692-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2692-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

resource	yara_rule
behavioral1/memory/2692-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2692-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2692-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2692-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2692-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2692-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2692-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2692-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2692-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2692-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2692-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2692-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2692-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2692-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2692-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2692-29-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2692-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2692-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2692-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2692-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2668	powershell.exe
2876	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
2692	RegSvcs.exe
2692	RegSvcs.exe
2668	powershell.exe
2876	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
Token: SeDebugPrivilege	2692	RegSvcs.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2668	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	28
PID 1688 wrote to memory of 2668	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	28
PID 1688 wrote to memory of 2668	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	28
PID 1688 wrote to memory of 2668	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	28
PID 1688 wrote to memory of 2876	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	30
PID 1688 wrote to memory of 2876	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	30
PID 1688 wrote to memory of 2876	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	30
PID 1688 wrote to memory of 2876	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	30
PID 1688 wrote to memory of 2648	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	32
PID 1688 wrote to memory of 2648	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	32
PID 1688 wrote to memory of 2648	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	32
PID 1688 wrote to memory of 2648	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	32
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34
PID 1688 wrote to memory of 2692	1688	c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe	34

C:\Users\Admin\AppData\Local\Temp\c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe
"C:\Users\Admin\AppData\Local\Temp\c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c3fb8862aa52c578aca75ee923448a3013ff97e2ebe3b0dad8d6d708e78262bf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GDBGcnlB.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GDBGcnlB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84E9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp84E9.tmp

Filesize
1KB

MD5
c3929f09af0617cad6795e53a322cfba

SHA1
f7732b106ec2e22099cb869ed9482bf3cadf1b28

SHA256
b0686d71626fb65e20be1fe190c4afbabc6b0d4907e26ebf3a083036dbae0cd9

SHA512
26947caa85b4815c5c237a83023844125a3c058a752f14f5d3ce761d44f151504840ca7980d09ca8028e58fa8671fe04cde473780bffe3baf2fbf5fa0b069706

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1BEBQWV1SJMJ5KMFNT3G.temp

Filesize
7KB

MD5
37fb1c8681f9d9d770f06d1d8ddf81c9

SHA1
08a9f31146e944698ea88d99c9352ee350eb5ae1

SHA256
6262f1195e5bc6c75ab9efcf57dd34937caaf44937adc932796396f4919de46a

SHA512
4011e511ce6991de28c596bfcc3e0f5755e08ba4c2b458575553036fdc55c58fb0b2ca689d22fba142ce7c0568943d371c2274c388d821ae39f65f8220577cb0

Download Submit
memory/1688-30-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1688-1-0x0000000001080000-0x0000000001156000-memory.dmp

Filesize
856KB

Download
memory/1688-2-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1688-3-0x00000000005C0000-0x00000000005DA000-memory.dmp

Filesize
104KB

Download
memory/1688-4-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/1688-5-0x0000000005590000-0x0000000005614000-memory.dmp

Filesize
528KB

Download
memory/1688-0-0x0000000074B9E000-0x0000000074B9F000-memory.dmp

Filesize
4KB

Download
memory/2692-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2692-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2692-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2692-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2692-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2692-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2692-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads