agenttesla | 2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4

General

Target

2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
Size

804KB
MD5

09072c63bf6b7b4b16c4000cd15faf69
SHA1

48b7f88573ca5849ae1bb2495ae35602baf83f41
SHA256

2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4
SHA512

d18d9e50e65a56e7553792517f79414373ed0e5d631a9e7789c6e1b5ac5b98f8c9c7066b1f5c4a3498fec0e2661b2c3efb85b0d7788965221602f5978a557b87
SSDEEP

24576:ECTC3c6eWT56abnuA4y4pCmncHCHzs8j4gtY+VTqCI:Eyq56abnuNpCmncH81j4gtY+VTqd

Score

10^/10

agenttesla execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tajhiz-gostaran.com
Port:
587
Username:
[email protected]
Password:
Ohv@dRNG{N^grViQHl
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2708	powershell.exe
2620	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1276	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
2500	RegSvcs.exe
2500	RegSvcs.exe
2708	powershell.exe
2620	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
Token: SeDebugPrivilege	2500	RegSvcs.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2708	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	28
PID 2580 wrote to memory of 2708	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	28
PID 2580 wrote to memory of 2708	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	28
PID 2580 wrote to memory of 2708	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	28
PID 2580 wrote to memory of 2620	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	30
PID 2580 wrote to memory of 2620	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	30
PID 2580 wrote to memory of 2620	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	30
PID 2580 wrote to memory of 2620	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	30
PID 2580 wrote to memory of 1276	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	32
PID 2580 wrote to memory of 1276	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	32
PID 2580 wrote to memory of 1276	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	32
PID 2580 wrote to memory of 1276	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	32
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34
PID 2580 wrote to memory of 2500	2580	2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe	34

C:\Users\Admin\AppData\Local\Temp\2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe
"C:\Users\Admin\AppData\Local\Temp\2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2a2618a79dcdef968ffdbd83eac1a15d705f3ce189f6ef5b506b1235a3f6b8e4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hssWuq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hssWuq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A57.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6A57.tmp

Filesize
1KB

MD5
557a52a60420996c29b3200a6ae43693

SHA1
aaae599ac574e30a8167d1e79a74c089c93afc06

SHA256
61fb4b522197742850dd61619b60e30034f82913bfd84262a5de25e70e8a9396

SHA512
0f097897f4be194940c248d8d8f0e0358ac5ea41edb12c87c23449c16adf3c88e9c1daff047c656229b295a34c27aa5a00c9ea43cdf26490eecbfcdf2a97eb7d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NSN1RI08LTPWTNKIPUQ6.temp

Filesize
7KB

MD5
26a43fafc7ea962237e8bcbe060da62f

SHA1
fa2c9672e00f1b16ffa9f8a0d341ca9874aca313

SHA256
adcd1b6a18caa19bef8329ee49445a0e38b55b157c669fdca857e81540a23e28

SHA512
a619c15a1d733867e88b2e5bcb8ef0178a734b65602674219155e8394266615a2991e332650b09af8b3f84465d6c01c2fad306d41708f6bae20ef122a1e30d3e

Download Submit
memory/2500-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2500-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2500-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2580-6-0x00000000053B0000-0x0000000005434000-memory.dmp

Filesize
528KB

Download
memory/2580-1-0x00000000013D0000-0x000000000149A000-memory.dmp

Filesize
808KB

Download
memory/2580-0-0x0000000073F4E000-0x0000000073F4F000-memory.dmp

Filesize
4KB

Download
memory/2580-2-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/2580-3-0x0000000000A90000-0x0000000000AA6000-memory.dmp

Filesize
88KB

Download
memory/2580-5-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Filesize
64KB

Download
memory/2580-4-0x0000000000AB0000-0x0000000000ABE000-memory.dmp

Filesize
56KB

Download
memory/2580-32-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads