agenttesla | 8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15

General

Target

8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
Size

681KB
MD5

722933abdf7d14140b75416407ab022f
SHA1

62bf1ea28e5d5c1ca43f969b6850da2529c8eba6
SHA256

8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15
SHA512

cd4d80f308c19ccd628d044042b30a24a63e075f50242d4623ec1331708e14d71ebb4811fe2a236612bb67090bc383e05e0817e938120d8566eacfa8764759f5
SSDEEP

12288:XLz/RiAIB6LhDrqDpEkvD5drAA+nBV+j5sMeKW6U8h/tLVlDIF6pj1KbIO4kR:7zZfIaedr7AA4S5kj03JIFc1S

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp5ua.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
11035517QWEiop@#$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2424-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2424-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2424-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2424-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2424-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2424-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2424-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2424-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2424-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2424-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2424-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2424-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2424-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2424-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2424-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2424-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2424-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2424-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2424-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2424-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2424-30-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2424-28-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2424-25-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2424-23-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2616 powershell.exe
2688 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2616	powershell.exe
2688	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe

description	pid	process	target process
PID 3036 set thread context of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2884 schtasks.exe

pid	process
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exepowershell.exepowershell.exe

pid	process
3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
2424	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
2424	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
2688	powershell.exe
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
Token: SeDebugPrivilege	2424	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
Token: SeDebugPrivilege	2688	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe

description	pid	process	target process
PID 3036 wrote to memory of 2616	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2616	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2616	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2616	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2688	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2688	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2688	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2688	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	powershell.exe
PID 3036 wrote to memory of 2884	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	schtasks.exe
PID 3036 wrote to memory of 2884	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	schtasks.exe
PID 3036 wrote to memory of 2884	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	schtasks.exe
PID 3036 wrote to memory of 2884	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	schtasks.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
PID 3036 wrote to memory of 2424	3036	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe	8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe

C:\Users\Admin\AppData\Local\Temp\8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
"C:\Users\Admin\AppData\Local\Temp\8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wizxKKeZE.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wizxKKeZE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA7F3.tmp"
2⤵
- Creates scheduled task(s)
PID:2884

C:\Users\Admin\AppData\Local\Temp\8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe
"C:\Users\Admin\AppData\Local\Temp\8ba0d4d313a7c67b7f9113bc7b26647b251fcea6a9efee3f05dcb88f249efd15.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA7F3.tmp
Filesize
1KB

MD5
94b9a43e91508e38526a96625dd9cad4

SHA1
3233b562bce52adf9d0733834d13ffb6f5a5d82b

SHA256
36cf99ada1fbf7599cefaafe1cae4babe47c1f001630417d9a48c00b7453f6e5

SHA512
c7612582dc8b6f2de7b68c1b6c820c143a53f0045bf45b5d5399d9a29ec809e8b474883856a4c9a96740e615d8677a04325be9a655549249b26091f91fe28481

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
8d959f730ec7f7406397edfe2e26d72b

SHA1
d39434372b007b46a3203e884ab886d108e2ba44

SHA256
6240e5eb77a505a22adf963bc75eceff03215756b216f712c2785b7c4c40e63b

SHA512
0db4c800f8f4d855f2a593c17a4e835db11e59659d68bca2836aa7281a9aca7c6a3f91314b6a198bfa93b5c9dd5cfa2ecea4901b647e8338e5bcdf347694aa1d

Download Submit
memory/2424-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2424-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2424-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2424-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2424-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2424-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2424-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2424-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3036-6-0x00000000052B0000-0x0000000005332000-memory.dmp

Filesize
520KB

Download
memory/3036-1-0x0000000001090000-0x000000000113C000-memory.dmp

Filesize
688KB

Download
memory/3036-0-0x000000007494E000-0x000000007494F000-memory.dmp

Filesize
4KB

Download
memory/3036-2-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-3-0x0000000000F80000-0x0000000001020000-memory.dmp

Filesize
640KB

Download
memory/3036-5-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/3036-4-0x00000000005A0000-0x00000000005BA000-memory.dmp

Filesize
104KB

Download
memory/3036-31-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads