agenttesla | aeed87f06c1d73acfe30d7bed14be7929caea7c5011582b8a807c8c72e88582f

General

Target

PO 4500029546 (Copy-)Tool 9458715.exe
Size

914KB
MD5

26701b0924135efc188c048ad4219be1
SHA1

0005c0f0d53c98e8d6cd26a095b0ab41026b078f
SHA256

aeed87f06c1d73acfe30d7bed14be7929caea7c5011582b8a807c8c72e88582f
SHA512

fef8f2afc197bbd273cd6eb7381b98374438c5a268360f8a0c94eb8327033b709ee5a92bcfc8f0c3ee99bef2389a558e84f7500d92052b1b972a4c73878cb77d
SSDEEP

12288:hx1JzsNK2Vyc81/fWSdVVhQiQf2oUMfqtLQhRUCYXo0eQGf8fTz6vIP8J0HkZqyn:mVuBVhQHfbU0zMzet8TWD2EwkD3

Score

10^/10

agenttesla execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
Asaprocky11
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3060	powershell.exe
2668	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2480	RegSvcs.exe
2480	RegSvcs.exe
3060	powershell.exe
2668	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	RegSvcs.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3060	2756	PO 4500029546 (Copy-)Tool 9458715.exe	28
PID 2756 wrote to memory of 3060	2756	PO 4500029546 (Copy-)Tool 9458715.exe	28
PID 2756 wrote to memory of 3060	2756	PO 4500029546 (Copy-)Tool 9458715.exe	28
PID 2756 wrote to memory of 3060	2756	PO 4500029546 (Copy-)Tool 9458715.exe	28
PID 2756 wrote to memory of 2668	2756	PO 4500029546 (Copy-)Tool 9458715.exe	30
PID 2756 wrote to memory of 2668	2756	PO 4500029546 (Copy-)Tool 9458715.exe	30
PID 2756 wrote to memory of 2668	2756	PO 4500029546 (Copy-)Tool 9458715.exe	30
PID 2756 wrote to memory of 2668	2756	PO 4500029546 (Copy-)Tool 9458715.exe	30
PID 2756 wrote to memory of 2588	2756	PO 4500029546 (Copy-)Tool 9458715.exe	32
PID 2756 wrote to memory of 2588	2756	PO 4500029546 (Copy-)Tool 9458715.exe	32
PID 2756 wrote to memory of 2588	2756	PO 4500029546 (Copy-)Tool 9458715.exe	32
PID 2756 wrote to memory of 2588	2756	PO 4500029546 (Copy-)Tool 9458715.exe	32
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34
PID 2756 wrote to memory of 2480	2756	PO 4500029546 (Copy-)Tool 9458715.exe	34

C:\Users\Admin\AppData\Local\Temp\PO 4500029546 (Copy-)Tool 9458715.exe
"C:\Users\Admin\AppData\Local\Temp\PO 4500029546 (Copy-)Tool 9458715.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO 4500029546 (Copy-)Tool 9458715.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kQXieICysI.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kQXieICysI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56E6.tmp"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp56E6.tmp

Filesize
1KB

MD5
8db167b07d6a8ca03a90687ae28afce4

SHA1
02f6da6f596ffa049d49f87122b4f7d30ab950ea

SHA256
5063fd45b473c696dc1a7b11dd4d666dc7aa42911dbd846a70a67aa4beef1d53

SHA512
847e0d595673ce4e9efe72ac2bc7310915b58384e6e94c191ed7597abbbc9f7bfc632718b9c3f89844d50dfb02f00a0fe762b9383afb74b7fcd50812c81da3b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XT8GLJHKQ4G6OZRC5IND.temp

Filesize
7KB

MD5
f43fd0576f0ad8e723f2336b4b3b4dbf

SHA1
a6c195fe61d1dbf80cdb935076cf741f9be61c29

SHA256
50ab2dc90cf657f3c03e5a91357f48599ddea2c9a3411ecc9e29160f3333d38d

SHA512
2bbd4329452849f86ce218f38cebed4a95feb8bec921d692add79f9a5c1218facf7e5944f3bf41ac5b076c3312dfa31f79704896ef3e71f6bf53d87de09efce0

Download Submit
memory/2480-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2480-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2480-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2756-6-0x0000000005260000-0x00000000052E2000-memory.dmp

Filesize
520KB

Download
memory/2756-1-0x0000000001120000-0x000000000120A000-memory.dmp

Filesize
936KB

Download
memory/2756-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2756-2-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2756-3-0x00000000004E0000-0x00000000004F2000-memory.dmp

Filesize
72KB

Download
memory/2756-5-0x0000000000B90000-0x0000000000B9C000-memory.dmp

Filesize
48KB

Download
memory/2756-4-0x00000000009A0000-0x00000000009A8000-memory.dmp

Filesize
32KB

Download
memory/2756-32-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads