agenttesla | 98aa8b33fa91a8814ad7cf94ec1fd53384844a9904c32103326e9794867da2c2

General

Target

PI #OVES1912196.scr
Size

826KB
MD5

1b136a73f10f2b2b837c46161eceaba9
SHA1

0bb6bfbd1a79432f03e1b51f697f664a628a5e90
SHA256

7df1b33f35a3ca87f9242153c847cc0d8e1d45c7e3b5c5ecf9f23bddbf94b052
SHA512

30a82ab4146edf04179f53dc0527baf9b7bb8c82288009cb6704c47ba1c735ca96a57206a739d209b7ed3615ae52847d2f4a0ec8b1e889d06b323051ee344e30
SSDEEP

24576:wiHxlaIGgVnElx5T6GMgitt8p10uF2VtQ/2:wiHxlaHl/6GtitGf0uF2VtQ/2

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
BIGNAIRA2024
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2780	powershell.exe
2712	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2424 set thread context of 2792	2424	PI #OVES1912196.scr	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PI #OVES1912196.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2424	PI #OVES1912196.scr
2424	PI #OVES1912196.scr
2780	powershell.exe
2712	powershell.exe
2424	PI #OVES1912196.scr
2792	RegSvcs.exe
2792	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	PI #OVES1912196.scr
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2792	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2780	2424	PI #OVES1912196.scr	31
PID 2424 wrote to memory of 2780	2424	PI #OVES1912196.scr	31
PID 2424 wrote to memory of 2780	2424	PI #OVES1912196.scr	31
PID 2424 wrote to memory of 2780	2424	PI #OVES1912196.scr	31
PID 2424 wrote to memory of 2712	2424	PI #OVES1912196.scr	33
PID 2424 wrote to memory of 2712	2424	PI #OVES1912196.scr	33
PID 2424 wrote to memory of 2712	2424	PI #OVES1912196.scr	33
PID 2424 wrote to memory of 2712	2424	PI #OVES1912196.scr	33
PID 2424 wrote to memory of 2744	2424	PI #OVES1912196.scr	34
PID 2424 wrote to memory of 2744	2424	PI #OVES1912196.scr	34
PID 2424 wrote to memory of 2744	2424	PI #OVES1912196.scr	34
PID 2424 wrote to memory of 2744	2424	PI #OVES1912196.scr	34
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37
PID 2424 wrote to memory of 2792	2424	PI #OVES1912196.scr	37

C:\Users\Admin\AppData\Local\Temp\PI #OVES1912196.scr
"C:\Users\Admin\AppData\Local\Temp\PI #OVES1912196.scr" /S
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PI #OVES1912196.scr"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OKOdVL.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OKOdVL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF863.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF863.tmp

Filesize
1KB

MD5
0d5fa15c76802d0b74f0bb0346e857d4

SHA1
a9127b8bc0a961e3dacf5eaf93a7d8f55d01dbe6

SHA256
d940413ad1b2b554c8a6742066ede4df20bbd497710a571bf8e63aef593c5184

SHA512
912d3f6632c1c9205bd891ecdf711289b94e4ef7e414f2cdda297c5bafc684045af24586709a816cfc776eb19d5f3b0688698efba9367c0cf2b83e42e9373ada

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ANKIT6S5396H75PXJ536.temp

Filesize
7KB

MD5
af4b29be8744e67e3320fc111c819c09

SHA1
a7f55fcd9e0ddf911276be83324ccbeb959ff5d6

SHA256
60515aa019faac5ff82bbf7fbe31a25c7a0dd514c675d437c609e0ea1bfe3dcc

SHA512
333f0ac91979c419e95aa06aa54a3a38cbc8ce7c38251528f3d4dad89fd5570604d1c6e8aa0b3db56b736fdab7fca4df9917dddc6feef91cd4d97a781edebdd4

Download Submit
memory/2424-4-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2424-31-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2424-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2424-5-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2424-6-0x0000000005410000-0x0000000005492000-memory.dmp

Filesize
520KB

Download
memory/2424-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2424-1-0x0000000000970000-0x0000000000A44000-memory.dmp

Filesize
848KB

Download
memory/2424-3-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/2792-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-28-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-23-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2792-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads