agenttesla | bc311f2845a756c0ff57e94abac7f894e60338ddc08187324154005d45c32456

General

Target

leylaty-RAK-16.02.2021,pdf.exe
Size

922KB
MD5

98e4d53f6ddd58d28af89b921bf5d6ea
SHA1

83486dab455ecedbe530ff267958cc07e2ed6f5d
SHA256

a710f59d3a9366dcac9bf7ead6fc0382b72373fe55e97bc32e3149960ed41bea
SHA512

39774eff85e9485fa39ad12fd0e832b64f746c3da7c448c1a270977e8c5ee11ae205cc5e787d4216bf448b511f9e03b0b5b9257df73bbfd5356dca1bcc2bb997
SSDEEP

24576:8fJ6Y86Z7iYtU+wkxQqBwtfLoA8A5jBmj:aJZ7iYtvBwtj18AZBmj

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sizetekstil.com
Port:
587
Username:
[email protected]
Password:
wsxa58ax

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 5 IoCs

resource	yara_rule
behavioral1/memory/2644-15-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2644-26-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2644-21-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2644-19-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2644-16-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2508 set thread context of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leylaty-RAK-16.02.2021,pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	leylaty-RAK-16.02.2021,pdf.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2508	leylaty-RAK-16.02.2021,pdf.exe
2508	leylaty-RAK-16.02.2021,pdf.exe
2644	leylaty-RAK-16.02.2021,pdf.exe
2644	leylaty-RAK-16.02.2021,pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	leylaty-RAK-16.02.2021,pdf.exe
Token: SeDebugPrivilege	2644	leylaty-RAK-16.02.2021,pdf.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2604	2508	leylaty-RAK-16.02.2021,pdf.exe	31
PID 2508 wrote to memory of 2604	2508	leylaty-RAK-16.02.2021,pdf.exe	31
PID 2508 wrote to memory of 2604	2508	leylaty-RAK-16.02.2021,pdf.exe	31
PID 2508 wrote to memory of 2604	2508	leylaty-RAK-16.02.2021,pdf.exe	31
PID 2508 wrote to memory of 2996	2508	leylaty-RAK-16.02.2021,pdf.exe	33
PID 2508 wrote to memory of 2996	2508	leylaty-RAK-16.02.2021,pdf.exe	33
PID 2508 wrote to memory of 2996	2508	leylaty-RAK-16.02.2021,pdf.exe	33
PID 2508 wrote to memory of 2996	2508	leylaty-RAK-16.02.2021,pdf.exe	33
PID 2508 wrote to memory of 3048	2508	leylaty-RAK-16.02.2021,pdf.exe	34
PID 2508 wrote to memory of 3048	2508	leylaty-RAK-16.02.2021,pdf.exe	34
PID 2508 wrote to memory of 3048	2508	leylaty-RAK-16.02.2021,pdf.exe	34
PID 2508 wrote to memory of 3048	2508	leylaty-RAK-16.02.2021,pdf.exe	34
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35
PID 2508 wrote to memory of 2644	2508	leylaty-RAK-16.02.2021,pdf.exe	35

C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\Kmeefc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp619.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe"
  2⤵
  PID:2996
- C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe"
  2⤵
  PID:3048
- C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\leylaty-RAK-16.02.2021,pdf.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp619.tmp

Filesize
1KB

MD5
663dd54d3a639679346151e4f9c94e71

SHA1
e621d7abe944a23a20e19541cf183ac1edf75dba

SHA256
f27e15aecc875dc9395f522b35b5302f2924c19b43ccb9539bb4605e575147dc

SHA512
af8808450ab8a236ecd53dfe3638533a8ee5f88b893c2e1a688b43eee744c23ed3d24b098f860e896a360066283e899bf09a75a9feb35908d759d31af89bf53b

Download Submit
memory/2508-0-0x00000000743CE000-0x00000000743CF000-memory.dmp

Filesize
4KB

Download
memory/2508-1-0x0000000000200000-0x00000000002EC000-memory.dmp

Filesize
944KB

Download
memory/2508-2-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2508-3-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/2508-4-0x00000000743CE000-0x00000000743CF000-memory.dmp

Filesize
4KB

Download
memory/2508-5-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2508-6-0x0000000004DA0000-0x0000000004E0C000-memory.dmp

Filesize
432KB

Download
memory/2508-25-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-26-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2644-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2644-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2644-24-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-21-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2644-19-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2644-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2644-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2644-14-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2644-27-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-28-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-29-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads