agenttesla | c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c

General

Target

c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
Size

750KB
MD5

cfb3b1cee475fed60cfd7ddb63e3021a
SHA1

0df13ccd6cce6679d4525e54b264bfc0b772458a
SHA256

c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c
SHA512

0943b45e0b7742981462fcfb785332fd67289c81c44d39798e2b9c02ad7f208e1cf7c5f036a658ca4787809b82f3dd1b836e9d5479e9fbfff0997f664839cb19
SSDEEP

12288:ywuV8Wf5fjKcjnW1VebF6ieLCtox0mjdZvR2imR5Pan5DsxZvD+yEGu16q7gjkrm:ywlyAoW1C6i3ox0QZvE53Sn5DsxZvDWg

Score

10^/10

agenttesla credential_access discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
evdanco.ru
Port:
587
Username:
[email protected]
Password:
[xkgyDSlzA(_
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2740	powershell.exe
2724	powershell.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\VsUPptm = "C:\\Users\\Admin\\AppData\\Roaming\\VsUPptm\\VsUPptm.exe"	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
2984	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
2984	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
2740	powershell.exe
2724	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
Token: SeDebugPrivilege	2984	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2984	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2724	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	30
PID 3004 wrote to memory of 2724	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	30
PID 3004 wrote to memory of 2724	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	30
PID 3004 wrote to memory of 2724	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	30
PID 3004 wrote to memory of 2740	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	32
PID 3004 wrote to memory of 2740	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	32
PID 3004 wrote to memory of 2740	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	32
PID 3004 wrote to memory of 2740	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	32
PID 3004 wrote to memory of 2820	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	33
PID 3004 wrote to memory of 2820	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	33
PID 3004 wrote to memory of 2820	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	33
PID 3004 wrote to memory of 2820	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	33
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36
PID 3004 wrote to memory of 2984	3004	c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe	36

C:\Users\Admin\AppData\Local\Temp\c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
"C:\Users\Admin\AppData\Local\Temp\c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YggtHhDjSOrBu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YggtHhDjSOrBu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp79A3.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe
  "C:\Users\Admin\AppData\Local\Temp\c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp79A3.tmp

Filesize
1KB

MD5
64f260d5943fa2453eed465a8bde23ff

SHA1
3efa72b46a87829bc28511a23757a7d0f9041d67

SHA256
f0cbdea57685f35f5846ce44c734bbbe5ecd00acd8fefc89fa0474667a72364d

SHA512
694f245850a78c0b54b1012ef40df75cf8b9bd64b68c55c5442047492f7154249b6ddab1746dbb51a5c85c43dadd31ee7fb333ab426817a2eae820318d8b4411

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
196aac7681e80ed6b3f542c9505db1b4

SHA1
2f92c5aa34f6f6c360d21cdcaeb2bca065be7573

SHA256
5af54d86a260b5292d4c93837c3f1b479e171d0f70a77547fa30cab0bcfd9c83

SHA512
c2f9e29907cfc4e7c5f5a64dd31834957b408192040d124aab949c77cd952eb94e4afd1884114c10bc2cf7fac25722ab64fa44b3446b1220066b229a3c46f021

Download Submit
C:\Users\Admin\AppData\Roaming\VsUPptm\VsUPptm.exe

Filesize
750KB

MD5
cfb3b1cee475fed60cfd7ddb63e3021a

SHA1
0df13ccd6cce6679d4525e54b264bfc0b772458a

SHA256
c561f79451f89d62151c3c01db971fa2f93813b1c190e8dad600111b6e68543c

SHA512
0943b45e0b7742981462fcfb785332fd67289c81c44d39798e2b9c02ad7f208e1cf7c5f036a658ca4787809b82f3dd1b836e9d5479e9fbfff0997f664839cb19

Download Submit
memory/2984-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-27-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2984-24-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2984-25-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2984-30-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2984-33-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2984-31-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2984-21-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3004-2-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-3-0x0000000001210000-0x00000000012B8000-memory.dmp

Filesize
672KB

Download
memory/3004-8-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/3004-7-0x00000000050E0000-0x000000000516A000-memory.dmp

Filesize
552KB

Download
memory/3004-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/3004-4-0x00000000002E0000-0x00000000002F4000-memory.dmp

Filesize
80KB

Download
memory/3004-6-0x0000000000550000-0x000000000055E000-memory.dmp

Filesize
56KB

Download
memory/3004-5-0x0000000000430000-0x000000000043A000-memory.dmp

Filesize
40KB

Download
memory/3004-34-0x0000000074B80000-0x000000007526E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-1-0x00000000013C0000-0x0000000001482000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads