agenttesla | 03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af

General

Target

03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
Size

936KB
MD5

13fa3ac707276053a6e3e8b3885e2274
SHA1

d862b433d8399dadf0cc82fdd181fffca6a436f5
SHA256

03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af
SHA512

b4e3f7c4b772c9cfa3b8f62c431d28aeef3f5e01cd53faa8f5ac8edb9b73a3946199fa05ebe20399007fdeb84d44107c48fbdbf5815c54b43386615cb2207da1
SSDEEP

12288:KDZkwvenl0h3J3cG/kVhKIQrnAfhY40pQTuLL64KJuXZckR:EZkwveip5/yhKLAfgpQTuaxJuZ

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
zqamcx.com
Port:
587
Username:
[email protected]
Password:
Methodman991
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2808 powershell.exe
2544 powershell.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2808	powershell.exe
2544	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

description	pid	process	target process
PID 2244 set thread context of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1648 schtasks.exe

pid	process
1648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exepowershell.exepowershell.exe03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

pid	process
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2808	powershell.exe
2544	powershell.exe
2844	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
2844	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exepowershell.exepowershell.exe03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

description	pid	process
Token: SeDebugPrivilege	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2844	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

pid process

2844 03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

pid	process
2844	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

description	pid	process	target process
PID 2244 wrote to memory of 2808	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 2808	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 2808	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 2808	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 2544	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 2544	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 2544	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 2544	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	powershell.exe
PID 2244 wrote to memory of 1648	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	schtasks.exe
PID 2244 wrote to memory of 1648	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	schtasks.exe
PID 2244 wrote to memory of 1648	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	schtasks.exe
PID 2244 wrote to memory of 1648	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	schtasks.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
PID 2244 wrote to memory of 2844	2244	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe	03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe

C:\Users\Admin\AppData\Local\Temp\03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
"C:\Users\Admin\AppData\Local\Temp\03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bYJpHSBIQhU.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bYJpHSBIQhU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD836.tmp"
2⤵
- Creates scheduled task(s)
PID:1648

C:\Users\Admin\AppData\Local\Temp\03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe
"C:\Users\Admin\AppData\Local\Temp\03dff69ef246481d70ab1a83fe3273348d165a1bab36c664dce64fa0bd5236af.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2844

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD836.tmp
Filesize
1KB

MD5
d1b8ce78f5ee5948ba75f0f355a76f61

SHA1
9782de78f213ce053a20de2579d8f07fca843af4

SHA256
9db9575c24c8f9e43932dafac0b8caee4caa4f386252453a7d4836cd32c77f02

SHA512
f05ed4466d6a9fb1a22f681f173a9d0062c02db21b39c2f41a233a42660c957c7cb95eaa3c732230a0f59b687bca7b35bd8c53123618b0fba207c388c377674b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
07826bfa2aef3da10d6abf6378432b9b

SHA1
c5888838e1f3841fd0ec64fa550afbd356e02399

SHA256
e6a8cd4042d16bdf6ffa5445ee06a085f7d54b9541e93267a439b7276d639a5f

SHA512
2afee67732afd723fe6c3a9a9750a5581bac719ce2f536dfff5849d12e64d5e01cc8c7d365e6933fcfc867901adc2050926717406b8ee05ab59c6b28d6f8e016

Download Submit
memory/2244-4-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/2244-3-0x0000000000500000-0x000000000051A000-memory.dmp

Filesize
104KB

Download
memory/2244-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2244-5-0x0000000004F20000-0x0000000004FA4000-memory.dmp

Filesize
528KB

Download
memory/2244-6-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2244-7-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2244-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2244-1-0x0000000000C00000-0x0000000000CEE000-memory.dmp

Filesize
952KB

Download
memory/2244-32-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2844-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2844-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2844-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads