agenttesla | b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc

General

Target

b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
Size

723KB
MD5

b0fb3afb79202119f008039e193e3066
SHA1

c5b5afc6a5d061d205ca5f3e08f6e6bcabd3a4e9
SHA256

b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc
SHA512

00cd06d946119ae8083eb6789985887e4ec8545d0e348823ca90e311b3c6e0df10a2189251d5a33ec21ed54822a36da84f82a1bce8fb7c4825b2c9249a2cbb97
SSDEEP

12288:OX0pxPV36Di8BtLaygAJWFpkgBsRW3ixBKGcd4bc/UkaBSdcJkGu2IqaBAhG3MRZ:tBFKYkJPgeKVGcCEV/d4kGu2I3yP/

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.rtatlas.com
Port:
587
Username:
[email protected]
Password:
jrratlas95*+
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

resource	yara_rule
behavioral1/memory/2228-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2228-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2228-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2228-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2228-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

resource	yara_rule
behavioral1/memory/2228-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2228-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2228-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2228-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2228-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

resource	yara_rule
behavioral1/memory/2228-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2228-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2228-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2228-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2228-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2228-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2228-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2228-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2228-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2228-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2228-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2228-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2228-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2228-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2228-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2228-28-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2228-30-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2228-27-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2228-24-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2228-22-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2724	powershell.exe
3032	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2176 set thread context of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
2724	powershell.exe
3032	powershell.exe
2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
2228	RegSvcs.exe
2228	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2228	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2724	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	28
PID 2176 wrote to memory of 2724	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	28
PID 2176 wrote to memory of 2724	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	28
PID 2176 wrote to memory of 2724	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	28
PID 2176 wrote to memory of 3032	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	30
PID 2176 wrote to memory of 3032	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	30
PID 2176 wrote to memory of 3032	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	30
PID 2176 wrote to memory of 3032	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	30
PID 2176 wrote to memory of 2604	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	31
PID 2176 wrote to memory of 2604	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	31
PID 2176 wrote to memory of 2604	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	31
PID 2176 wrote to memory of 2604	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	31
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34
PID 2176 wrote to memory of 2228	2176	b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe	34

C:\Users\Admin\AppData\Local\Temp\b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe
"C:\Users\Admin\AppData\Local\Temp\b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4db822fef33feb78cf74c835c5bb0ade28759d4c5d2ced9cdb410e472bab6cc.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wQgeLGE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wQgeLGE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D2B.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7D2B.tmp

Filesize
1KB

MD5
09f0719bd32755463440a4bc3aa5e9eb

SHA1
ec8696412a64b086f23fdcd452b2f7521b539fba

SHA256
98565f215757507ba1bd9046b3b92ada141a0665ad497ed3153873ccaaf56c58

SHA512
1cb048e1ee39d18cc6ac66a6530292590e746199be584e793740f6585dad197da46b8cba6a8c93659f49d8eb6e5130e7f4082d18aada0cca90998a8aa241d469

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
9e964e066d02b1b1c13e5206e1499761

SHA1
b2f05cbe806a16a2127bd25068f88a4d572c2afa

SHA256
9497caf2d7dd20547a19df2486aa45bcd4d7ab33d78f45c6d3463e78d1bc74d4

SHA512
8d8737ef94f637b5c64421bfe975d046dec5e42efbd199a611554fc58ae676bad80a1da75f93389e6ea0264ca12a85578eb3948fd2729130e7add78da458ef59

Download Submit
memory/2176-31-0x0000000074420000-0x0000000074B0E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-1-0x00000000013D0000-0x0000000001486000-memory.dmp

Filesize
728KB

Download
memory/2176-2-0x0000000074420000-0x0000000074B0E000-memory.dmp

Filesize
6.9MB

Download
memory/2176-3-0x00000000009A0000-0x00000000009C2000-memory.dmp

Filesize
136KB

Download
memory/2176-4-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/2176-5-0x0000000005920000-0x00000000059A4000-memory.dmp

Filesize
528KB

Download
memory/2176-0-0x000000007442E000-0x000000007442F000-memory.dmp

Filesize
4KB

Download
memory/2228-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2228-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2228-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads