agenttesla | 5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26

General

Target

5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
Size

639KB
MD5

29ef191ed82ea8c11cf1f99695ea0faf
SHA1

e9e71a843dec6db3f47f1d7b5c25044761e378d9
SHA256

5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26
SHA512

51d405194b0be85e75c0af8349e2585cc70ccadff7f2e54cb63cd6ef46b923e59907b0f0ef0318958bea87cf34e8441afe59c625cc781c78f16926186e50c476
SSDEEP

12288:7a7kvHzL2pOM7a1t0B51zwIkIGGvtmRM1SHTl7MKAdfwr2lCACZ5ymmkR:7aoHTsGIkCcRMQHOKGIreg5yQ

Score

10^/10

agenttesla credential_access discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.shaktiinstrumentations.in
Port:
587
Username:
[email protected]
Password:
Shakti54231!@#$%#@!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe
2908	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
2912	powershell.exe
2908	powershell.exe
2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
2624	RegSvcs.exe
2624	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2624	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2912	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	31
PID 2372 wrote to memory of 2912	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	31
PID 2372 wrote to memory of 2912	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	31
PID 2372 wrote to memory of 2912	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	31
PID 2372 wrote to memory of 2908	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	33
PID 2372 wrote to memory of 2908	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	33
PID 2372 wrote to memory of 2908	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	33
PID 2372 wrote to memory of 2908	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	33
PID 2372 wrote to memory of 2820	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	34
PID 2372 wrote to memory of 2820	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	34
PID 2372 wrote to memory of 2820	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	34
PID 2372 wrote to memory of 2820	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	34
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37
PID 2372 wrote to memory of 2624	2372	5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe	37

C:\Users\Admin\AppData\Local\Temp\5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe
"C:\Users\Admin\AppData\Local\Temp\5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5620e82c34754f8c0a8ee61597fd43b037e810f2dc2be1b2968dfbfee279bd26.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLSHXnJWplNm.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLSHXnJWplNm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDEDA.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDEDA.tmp

Filesize
1KB

MD5
299e291bd546bde0735ddbc742b53d21

SHA1
6fdbbdddcaae4b43675c7b6539cc599900cb8211

SHA256
0baf3ac84fde64dcf8a1f1ce1891338b3cb19fa2f69a51aa97b47e36b8cd66d7

SHA512
ee57ed5c9dca003ce2435d455f2d2a39108ad28880ee02a5e8ab2a93670b72eea2d441daec5b5650b8070920eb561bd028230e26b1bb4df18cc0cecdf9977f36

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X6SU5Z2G8F4HFBOQ49W5.temp

Filesize
7KB

MD5
f49e106c39899923a054391e1a6b876a

SHA1
9697471cf678ad99533ffe869f2762844a533afe

SHA256
1cd9ae95935d9d1170db3789d9e393510422d726dc0772f64ce332709e4dee76

SHA512
1172eee7f7edba1d99db4ed99d732793b332e36dada05d257076b7a4d1973af817cedc116cd5073610073113bdbe3bfb7ddd83f3371a32d822aace74721b96ed

Download Submit
memory/2372-4-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/2372-32-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-0-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/2372-5-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-6-0x0000000005D00000-0x0000000005D84000-memory.dmp

Filesize
528KB

Download
memory/2372-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2372-1-0x0000000000080000-0x0000000000122000-memory.dmp

Filesize
648KB

Download
memory/2372-3-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2624-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2624-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads