agenttesla | 28b3c09f079c35e84e7cb01688b99e15dc105a0abb481294e796d1d70db030a1

General

Target

Employee Handbook English.exe
Size

652KB
MD5

6554cf839ea2e5749ee45c9dffe7b16f
SHA1

dfa0c3d9e29d7498a7243b4137230049ba89fc0a
SHA256

28b3c09f079c35e84e7cb01688b99e15dc105a0abb481294e796d1d70db030a1
SHA512

c4332870bf03ec897cf5af0e18c33c8cd3e877c8bbc5dad9e552116ebf135774288e186e340c32cca1c0503f39144f21f1beb177542eef637052bc271cbf00fc
SSDEEP

12288:JdJS4Vk1mSR1mmsXYyJu1FbrOXsCWhU7UyOg/dnK2ViSqjDDLy:pSckDRNBTv0ZWKQyOsdK2nqjH2

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cemfa.com
Port:
587
Username:
[email protected]
Password:
mohamed@cemfa
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
2532	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 3028	992	Employee Handbook English.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
992	Employee Handbook English.exe
3028	MSBuild.exe
3028	MSBuild.exe
2532	powershell.exe
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	Employee Handbook English.exe
Token: SeDebugPrivilege	3028	MSBuild.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 2948	992	Employee Handbook English.exe	28
PID 992 wrote to memory of 2948	992	Employee Handbook English.exe	28
PID 992 wrote to memory of 2948	992	Employee Handbook English.exe	28
PID 992 wrote to memory of 2948	992	Employee Handbook English.exe	28
PID 992 wrote to memory of 2532	992	Employee Handbook English.exe	30
PID 992 wrote to memory of 2532	992	Employee Handbook English.exe	30
PID 992 wrote to memory of 2532	992	Employee Handbook English.exe	30
PID 992 wrote to memory of 2532	992	Employee Handbook English.exe	30
PID 992 wrote to memory of 2752	992	Employee Handbook English.exe	31
PID 992 wrote to memory of 2752	992	Employee Handbook English.exe	31
PID 992 wrote to memory of 2752	992	Employee Handbook English.exe	31
PID 992 wrote to memory of 2752	992	Employee Handbook English.exe	31
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34
PID 992 wrote to memory of 3028	992	Employee Handbook English.exe	34

C:\Users\Admin\AppData\Local\Temp\Employee Handbook English.exe
"C:\Users\Admin\AppData\Local\Temp\Employee Handbook English.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Employee Handbook English.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VhuFpqC.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VhuFpqC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA3AF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA3AF.tmp

Filesize
1KB

MD5
d26f8e4d27229bf0867d1c8eb02baaec

SHA1
05f2115e8162f39fdb94f4c2e8fc21ea395f032c

SHA256
0a742dbbf783eb7221674c8f6e381be4e0d253e1032d4e260f817ce77e38bb3b

SHA512
576fb510f3f987c9787416f3e0c05dc934f0d102de639f0106bde987d9f6603da580d1b536012634a5724d13c424fdc81b610f6a3a152f89d155701668f0de65

Download Submit
memory/992-4-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/992-30-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/992-3-0x00000000003E0000-0x00000000003F8000-memory.dmp

Filesize
96KB

Download
memory/992-0-0x00000000741FE000-0x00000000741FF000-memory.dmp

Filesize
4KB

Download
memory/992-5-0x0000000005300000-0x0000000005382000-memory.dmp

Filesize
520KB

Download
memory/992-6-0x00000000741FE000-0x00000000741FF000-memory.dmp

Filesize
4KB

Download
memory/992-7-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/992-1-0x0000000000EF0000-0x0000000000F9A000-memory.dmp

Filesize
680KB

Download
memory/992-2-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/3028-27-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-26-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3028-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3028-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads