agenttesla | 82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8

General

Target

82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
Size

742KB
MD5

c332cd50ce66d6b2cd13b5279c2a2081
SHA1

c1bc0c828c3c8bb168b8f25219f2b4112d67ea6f
SHA256

82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8
SHA512

39ff7c136f3d8ab2ca540b9be00c0e0ae350ddf5e4b9e4039bb4459f624092bd12f4260ca9960f2b59f63d04dcc044d5586b54a2c7ac9371f222e0ac2175494b
SSDEEP

12288:AUAdXtfETk6Nbnb1raLLgWQxpcagobqzwQ+LcnnbgwmGiCjoYGxE+GqvCEti+Ch:Add92VNbnhraLEHcavbqUQqwnbgMVjoY

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.merlinmotorworks.com
Port:
587
Username:
[email protected]
Password:
Merlin1080S
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
2512	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
2620	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
2620	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
2512	powershell.exe
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
Token: SeDebugPrivilege	2620	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2948	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	28
PID 1684 wrote to memory of 2948	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	28
PID 1684 wrote to memory of 2948	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	28
PID 1684 wrote to memory of 2948	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	28
PID 1684 wrote to memory of 2512	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	30
PID 1684 wrote to memory of 2512	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	30
PID 1684 wrote to memory of 2512	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	30
PID 1684 wrote to memory of 2512	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	30
PID 1684 wrote to memory of 2120	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	31
PID 1684 wrote to memory of 2120	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	31
PID 1684 wrote to memory of 2120	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	31
PID 1684 wrote to memory of 2120	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	31
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34
PID 1684 wrote to memory of 2620	1684	82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe	34

C:\Users\Admin\AppData\Local\Temp\82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
"C:\Users\Admin\AppData\Local\Temp\82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cvbGKRX.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cvbGKRX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA8AE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe
  "C:\Users\Admin\AppData\Local\Temp\82cbe9fc57abd337a5bf0d0d478ae7fb9158987c1d7c5006b20e309c06329ae8.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA8AE.tmp

Filesize
1KB

MD5
e530d2021cdcff62348c953dee9cd5ec

SHA1
f48ed72af2184bdc0137eda661297289d15b1d17

SHA256
dddcd03719292338ccf68ec4d005cd1d6d927259cdccb3cd888ad86ab166729b

SHA512
b232f07f345630375850e4841be22002de786e451078367fb6f20a4a6e82cd1e7cadc138965d8d6159faa23e6bbe988cb8c522f9fa9ccbbcba222c775377e3f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SLMH9KSYTJGCDDKOLDAH.temp

Filesize
7KB

MD5
fe755c71b578d7dce123ad604802fa25

SHA1
17a2d84d617c26bbf8462a6883c492bd3362bcb1

SHA256
80e574f5bca3a6738848e38b3120d69767318bd61d78f9cae812a235e4c7dcac

SHA512
00f9ba01167b5e9d5cacaaa6e869dd0550346334b78ab7fca643b68e4b030880cea4f193bdb10c221902abcc726e4ccd75b2e03f7fadf40d4b6d8f44da381b9d

Download Submit
memory/1684-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1684-3-0x0000000000880000-0x000000000089A000-memory.dmp

Filesize
104KB

Download
memory/1684-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/1684-5-0x00000000056B0000-0x0000000005734000-memory.dmp

Filesize
528KB

Download
memory/1684-6-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/1684-7-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-2-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-1-0x0000000000330000-0x00000000003EE000-memory.dmp

Filesize
760KB

Download
memory/1684-32-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/2620-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2620-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2620-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads