agenttesla | d018f0205697a897c38776ff24b58b8be868e5bc76599f3df0ffa114aaa2e600

General

Target

ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe
Size

891KB
MD5

c21a03ba2040ef6de6b522ce779a8399
SHA1

59a91fd925902d7d21829a5a4d57765f69db1369
SHA256

ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305
SHA512

fa92469d362d41e16a19ce615a341c4b8fd07805f5175074cbffc182733537f51f71e972029037bdf782dfdfcb47be33b7d35ca350e777fe3d9c0b1dc9905327
SSDEEP

24576:thFgZKs71DI5AGSHHZsxeosZWve9hDYwwppqO:zFgZKMXGSZsxeosZ6YN/O

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.issssteel.com
Port:
587
Username:
[email protected]
Password:
onyinyechi198724
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2716	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe
2716	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe
2584	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe
Token: SeDebugPrivilege	2584	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2716	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2584	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	28
PID 2868 wrote to memory of 2584	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	28
PID 2868 wrote to memory of 2584	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	28
PID 2868 wrote to memory of 2584	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	28
PID 2868 wrote to memory of 2656	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	30
PID 2868 wrote to memory of 2656	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	30
PID 2868 wrote to memory of 2656	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	30
PID 2868 wrote to memory of 2656	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	30
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32
PID 2868 wrote to memory of 2716	2868	ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe	32

C:\Users\Admin\AppData\Local\Temp\ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe
"C:\Users\Admin\AppData\Local\Temp\ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IfNaEnvFOSaGpt.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IfNaEnvFOSaGpt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp429C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2656
- C:\Users\Admin\AppData\Local\Temp\ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe
  "C:\Users\Admin\AppData\Local\Temp\ecb9115de92beb10b3344687dfe5a2147117302e02378f5592649d5761e33305.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp429C.tmp

Filesize
1KB

MD5
88df83ed76cf1356e152009e87a9b775

SHA1
4448d06f34068a33ff60a66cbaf1f5097896cf26

SHA256
8f34cbf8bd45767e0d6519e25a983cc7f95e23a45f0c4f4d20d4f15a32dff163

SHA512
f1d6de006286fe35273e1b4bda5cab793b72ccd0d21c71a0cdf3c5ccd56d304f5e49cd8874fcd28ec1142e582e98011e757a99752387a58bb30d9a5a3aebd76e

Download Submit
memory/2716-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2716-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2868-2-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2868-1-0x0000000000F90000-0x0000000001076000-memory.dmp

Filesize
920KB

Download
memory/2868-5-0x0000000005C60000-0x0000000005CE4000-memory.dmp

Filesize
528KB

Download
memory/2868-0-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/2868-4-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/2868-3-0x0000000000700000-0x000000000071A000-memory.dmp

Filesize
104KB

Download
memory/2868-25-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads