agenttesla | 444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf

General

Target

444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
Size

664KB
MD5

2f8f4c24f72ae76abaf7e2ac2f320b3d
SHA1

0dd76587c9dc2a4165284250cf26f53e10a6ab4a
SHA256

444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf
SHA512

d55807f3a904614e2e6730b7c337e370b92729be51fbb67f2b07065bbfefcbeea6ea1f2bfb3d831f9830ab9d5ffdfa0d59d14d1b3c0cf42f152f840aacbc8057
SSDEEP

12288:53bEupN6sR9/7MSwe/glfG2X5cXDCG4n5fn3tf8iqN6zuC6vaBPGB:dvpNb/7MLYquPzL68iqPCI0

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://eu-west-1.sftpcloud.io
Port:
21
Username:
13539f2504b743dd98521b85373d3634
Password:
trkZiFOREY2q6YnhGZIQbUOlqqfy5naj

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2676 powershell.exe
2624 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2676	powershell.exe
2624	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe

description	pid	process	target process
PID 2924 set thread context of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2600 schtasks.exe

pid	process
2600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exepowershell.exepowershell.exe

pid	process
2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
2488	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
2488	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
2676	powershell.exe
2624	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
Token: SeDebugPrivilege	2488	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe

description	pid	process	target process
PID 2924 wrote to memory of 2676	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2676	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2676	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2676	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2624	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2624	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2624	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2624	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	powershell.exe
PID 2924 wrote to memory of 2600	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	schtasks.exe
PID 2924 wrote to memory of 2600	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	schtasks.exe
PID 2924 wrote to memory of 2600	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	schtasks.exe
PID 2924 wrote to memory of 2600	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	schtasks.exe
PID 2924 wrote to memory of 2524	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2524	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2524	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2524	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
PID 2924 wrote to memory of 2488	2924	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe	444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe

C:\Users\Admin\AppData\Local\Temp\444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
"C:\Users\Admin\AppData\Local\Temp\444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cETOZZpqisdR.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cETOZZpqisdR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6BCD.tmp"
2⤵
- Creates scheduled task(s)
PID:2600

C:\Users\Admin\AppData\Local\Temp\444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
"C:\Users\Admin\AppData\Local\Temp\444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe"
2⤵
PID:2524

C:\Users\Admin\AppData\Local\Temp\444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe
"C:\Users\Admin\AppData\Local\Temp\444545470e7680f8dbbb8702aeb6dbe70f12fba4d11855d56dc628e7d6e055bf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2488

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

2

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6BCD.tmp
Filesize
1KB

MD5
9acc9bde691b145a063def6f8114aea6

SHA1
8a890737830a29d059f9ad353a0b97e249a1b150

SHA256
8b07043233838c299bdb474e3f83ae14a2bfb2d3a30d2b359764eb2b0e9e3413

SHA512
a0f015783daa8b9cf042b5696e6d0e2d72959dbaaadb3b483e39667588e0358ddf5673a5e469b073836ea4c91ed0a7a55099337851e72be098817f0c5c2b431e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
afaf1084e4f089f5b87492494f6cb808

SHA1
353abe726f4166147ecacd34e70250581d56efa1

SHA256
cbc4b9fa2b642a26d5ce2a90991da0a56c4d4ddb86cd4ce831e502e50f6cfc6b

SHA512
ac561e6f3ca9f41af8e6f3dba260d0f48db68bedda77fb79f654bfca9ffc29b28e59378adfd940bfbf08bec7d484d28772d7b5f49970a389958f6e4b85f3e769

Download Submit
memory/2488-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2488-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2488-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2924-6-0x00000000049C0000-0x0000000004A42000-memory.dmp

Filesize
520KB

Download
memory/2924-1-0x0000000000C70000-0x0000000000D1C000-memory.dmp

Filesize
688KB

Download
memory/2924-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/2924-2-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download
memory/2924-3-0x0000000000BC0000-0x0000000000C60000-memory.dmp

Filesize
640KB

Download
memory/2924-5-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/2924-4-0x0000000000510000-0x000000000052A000-memory.dmp

Filesize
104KB

Download
memory/2924-31-0x0000000074B40000-0x000000007522E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads