agenttesla | 622314078d28b0207d233d56ffd54de12e588cc1f2f430c081a8a984b3362069

General

Target

PO00211.exe
Size

717KB
MD5

a4d4780d7703925eff77e36e2485b5f6
SHA1

b61654691da57abecd6a4a1fe937a0cb3d51926a
SHA256

fffe301ce73fde6ee8c35f49fa5045ba25c37d433d657f885e10aae3c1c2b4c3
SHA512

43ffd31603200dcf8277851be8a40cc8bb2314c3e5815ca2805a8c0c05af259578e5cdaaf7551481b6641574f0927ba3cd1717fed456fffcc7eeb714a49498e8
SSDEEP

12288:LPOAef9Bz9TsGVtslqGunI1pj5esrZv/3v1VWCcbl3CisyCY2nBr2nLTMO+hg3kR:qhAlqGj9xZvPNEHhSi/u2nLT6hgi

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.formosabag.co.id
Port:
587
Username:
[email protected]
Password:
@2022exim02^^**
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2592	powershell.exe
2896	powershell.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\YxAesh = "C:\\Users\\Admin\\AppData\\Roaming\\YxAesh\\YxAesh.exe"	PO00211.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 2564	2204	PO00211.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2204	PO00211.exe
2204	PO00211.exe
2564	PO00211.exe
2564	PO00211.exe
2896	powershell.exe
2592	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	PO00211.exe
Token: SeDebugPrivilege	2564	PO00211.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2564	PO00211.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2592	2204	PO00211.exe	28
PID 2204 wrote to memory of 2592	2204	PO00211.exe	28
PID 2204 wrote to memory of 2592	2204	PO00211.exe	28
PID 2204 wrote to memory of 2592	2204	PO00211.exe	28
PID 2204 wrote to memory of 2896	2204	PO00211.exe	30
PID 2204 wrote to memory of 2896	2204	PO00211.exe	30
PID 2204 wrote to memory of 2896	2204	PO00211.exe	30
PID 2204 wrote to memory of 2896	2204	PO00211.exe	30
PID 2204 wrote to memory of 2608	2204	PO00211.exe	31
PID 2204 wrote to memory of 2608	2204	PO00211.exe	31
PID 2204 wrote to memory of 2608	2204	PO00211.exe	31
PID 2204 wrote to memory of 2608	2204	PO00211.exe	31
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34
PID 2204 wrote to memory of 2564	2204	PO00211.exe	34

C:\Users\Admin\AppData\Local\Temp\PO00211.exe
"C:\Users\Admin\AppData\Local\Temp\PO00211.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO00211.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\drpeBYm.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\drpeBYm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp38FB.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\PO00211.exe
  "C:\Users\Admin\AppData\Local\Temp\PO00211.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp38FB.tmp

Filesize
1KB

MD5
4d4c96d05950111f752f8620267a1bae

SHA1
5e1a34f04621d26d0c195c7c415f5be683979fc8

SHA256
54302b87bc376d4682c019875bbe866a453941d642cd9d5ffc8b545e249c0502

SHA512
e907c1ad5ab94157eaf27ec253174b8c8145d349db68381fe51e80ca3e8d1207ca9c4f4b16e9c2acaec0fc8e54f60c5759298753ce8888564844b148e7a82270

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5OKQ4DHJXHV81F0DW8MN.temp

Filesize
7KB

MD5
f3c1a38995a7ba6bcaf4c2d462366459

SHA1
611f651eca9acbc089213c1418dfdb2a5e7095cb

SHA256
9fc34b9c252517a9265b392a7a5d3710b0afa4db576911c165d825f7da73f1bc

SHA512
916d04ce263f0c9aab31b792bcb4891bf199ca795831e8b591c7bf3f20e42d437352628e11237fffd7e5a274d6ee76311b640b5e8fc1a2a81eacbb4d855dfdc3

Download Submit
memory/2204-31-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-1-0x0000000000E30000-0x0000000000EE4000-memory.dmp

Filesize
720KB

Download
memory/2204-2-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-3-0x0000000000580000-0x0000000000598000-memory.dmp

Filesize
96KB

Download
memory/2204-4-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/2204-5-0x0000000005DA0000-0x0000000005E24000-memory.dmp

Filesize
528KB

Download
memory/2204-0-0x000000007427E000-0x000000007427F000-memory.dmp

Filesize
4KB

Download
memory/2564-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2564-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2564-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads