agenttesla | 9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e

General

Target

9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe
Size

736KB
MD5

84396eb97e3ade6cd6689329d7ff3366
SHA1

8e8c061ece6bc8f36bad01514ba2869a343d456f
SHA256

9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e
SHA512

95460f92e93ff48045ab507a677d51065b10f068d4ad97d902e2e0f1f8b374c5ffcc8832a074cd964839818516c8e987ff818b408d509e3836cb5ce12145c63e
SSDEEP

12288:pbHMi8LkpEaFLVbmQNGvZE8kCyYYXPdap9+Fy8rM9NyPg1J7Pe5xfdzLA2S6Npjv:djEobHNGh7k5Yj+FlM984v7PY

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
marcellinus360
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2640	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2480 set thread context of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2276	RegSvcs.exe
2276	RegSvcs.exe
2640	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2276	RegSvcs.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2276	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2640	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	28
PID 2480 wrote to memory of 2640	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	28
PID 2480 wrote to memory of 2640	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	28
PID 2480 wrote to memory of 2640	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	28
PID 2480 wrote to memory of 2708	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	30
PID 2480 wrote to memory of 2708	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	30
PID 2480 wrote to memory of 2708	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	30
PID 2480 wrote to memory of 2708	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	30
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32
PID 2480 wrote to memory of 2276	2480	9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe	32

C:\Users\Admin\AppData\Local\Temp\9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe
"C:\Users\Admin\AppData\Local\Temp\9524dbdb7a13bdd04e736f32c96690df3320fabc8587bd0880db9ff0fd497c8e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YPYfbrVvOhaubH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YPYfbrVvOhaubH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D36.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4D36.tmp

Filesize
1KB

MD5
6e1af06685860091341487f051325100

SHA1
360b827f5759c6ba7a2a704dde733d189e73fa17

SHA256
ee50619dbff463824cefbe2bab49b772e25d0aa0fe40bb8fce443d60bb80aa53

SHA512
8203e1c9c5c3e20b2090a85008b2801576f7f6e0bc4665ce92255d29ab5700a234a489e70abda8924501b56b457826a196e0073f6c7e9ad89d9607dcdb77e594

Download Submit
memory/2276-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2276-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2276-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-2-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-1-0x0000000001290000-0x000000000134E000-memory.dmp

Filesize
760KB

Download
memory/2480-5-0x0000000007410000-0x0000000007494000-memory.dmp

Filesize
528KB

Download
memory/2480-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2480-4-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/2480-3-0x0000000000410000-0x000000000042A000-memory.dmp

Filesize
104KB

Download
memory/2480-25-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads