agenttesla | 9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6

General

Target

9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
Size

954KB
MD5

39979eccde1d73df5d59a1e89a37d264
SHA1

6232ebcc028be517c08cff570d640d5b21017c03
SHA256

9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6
SHA512

1ad462fa365f5e1a8935cc49953854f264d92e1cf9f22916300289f1875b69426473609b180be48e75fcb829df70b3d214f2144835f7de4c1b48c05b37c6c72f
SSDEEP

12288:L8vYjP1Mv0HQHffJTCCxGpL/+hhKcdSIY6q4mGa9v7GZB5mFr:L8vq68HGXJTF4Kb3jq4mGa9v2m

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
Password: )NYyffR0
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2336 powershell.exe
2732 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2336	powershell.exe
2732	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\mpTrle = "C:\\Users\\Admin\\AppData\\Roaming\\mpTrle\\mpTrle.exe"	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe

description	pid	process	target process
PID 3020 set thread context of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2832 schtasks.exe

pid	process
2832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exepowershell.exepowershell.exe

pid	process
3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
2600	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
2600	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
2336	powershell.exe
2732	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
Token: SeDebugPrivilege	2600	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe

description	pid	process	target process
PID 3020 wrote to memory of 2336	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2336	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2336	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2336	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2732	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2732	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2732	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2732	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	powershell.exe
PID 3020 wrote to memory of 2832	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	schtasks.exe
PID 3020 wrote to memory of 2832	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	schtasks.exe
PID 3020 wrote to memory of 2832	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	schtasks.exe
PID 3020 wrote to memory of 2832	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	schtasks.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
PID 3020 wrote to memory of 2600	3020	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe	9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe

C:\Users\Admin\AppData\Local\Temp\9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
"C:\Users\Admin\AppData\Local\Temp\9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DfhkBvp.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DfhkBvp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DCB.tmp"
2⤵
- Creates scheduled task(s)
PID:2832

C:\Users\Admin\AppData\Local\Temp\9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe
"C:\Users\Admin\AppData\Local\Temp\9705d75279cfe3ba81b4bd39c85cc10729bb44618f0c77a8954adf4fe4da24c6.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3DCB.tmp
Filesize
1KB

MD5
8f0401cefba5641bf6eb249a52b0f283

SHA1
620eb0e7cb9a5e1bc9891d34494fd60a25fc1b1f

SHA256
d91bfab4d14f6563aa50f84b14975508b4772d21d2ee3533fc857109577a5fd9

SHA512
6078ff5cdf2daa6b5e2020f2fcf19113944a236eb315dd44a5372170dd593cd4acc80ecbfa198fcbc57802bb62b2a1e7215bfba43e986ef274e1d99b4a1bf39f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H0BAIHVG00VX25OS1UMK.temp
Filesize
7KB

MD5
f074f382c962ad0e4a417ba71be3b71f

SHA1
8c7e958658b8c6e37536752bc8fcaa224df376a8

SHA256
6fb67dcb9d17e64e02d4c3ef56c7401cac948c38ef0593159f2f0582de403395

SHA512
56cb939eca0d6c9e0b9d38fc69da3f14477dcff93f925d1358f7eab50068c3e4c3960fc32dfb337930e424adb16ed6803204e863beaf9e3ada371929037e651b

Download Submit
memory/2600-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2600-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3020-2-0x0000000000920000-0x000000000093A000-memory.dmp

Filesize
104KB

Download
memory/3020-1-0x0000000000CE0000-0x0000000000DD4000-memory.dmp

Filesize
976KB

Download
memory/3020-0-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

Filesize
4KB

Download
memory/3020-3-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download
memory/3020-5-0x0000000005160000-0x00000000051E2000-memory.dmp

Filesize
520KB

Download
memory/3020-4-0x00000000008B0000-0x00000000008C0000-memory.dmp

Filesize
64KB

Download
memory/3020-31-0x0000000073F90000-0x000000007467E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads