agenttesla | d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3

General

Target

Ningbo - Past Due Invoices.scr.exe
Size

657KB
MD5

05971e8521240cd588015e689baab4b7
SHA1

1911d514d8e9d3310b2876ee591553250a31f44f
SHA256

d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3
SHA512

01db290b831f6e60efaa8bfeb8bb0e1f1137c7843b29da34f024ee6e4f4b2f341ed4f8f2ed7c1a202a7a99781224bfca8bbaf7479ba23796707fc3d0d9994448
SSDEEP

12288:pOjsJrm2DORelTAeZjqjhazCtH42QWkn5IxQMj7RYLgXeevG3j8bQb:pWsJrm2DO0TvqH42ZLuMj7GEXze3UI

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
BIGNAIRA2024
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2756	powershell.exe
2864	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ningbo - Past Due Invoices.scr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2416	Ningbo - Past Due Invoices.scr.exe
2416	Ningbo - Past Due Invoices.scr.exe
2756	powershell.exe
2864	powershell.exe
2416	Ningbo - Past Due Invoices.scr.exe
2780	RegSvcs.exe
2780	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	Ningbo - Past Due Invoices.scr.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2780	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2756	2416	Ningbo - Past Due Invoices.scr.exe	31
PID 2416 wrote to memory of 2756	2416	Ningbo - Past Due Invoices.scr.exe	31
PID 2416 wrote to memory of 2756	2416	Ningbo - Past Due Invoices.scr.exe	31
PID 2416 wrote to memory of 2756	2416	Ningbo - Past Due Invoices.scr.exe	31
PID 2416 wrote to memory of 2864	2416	Ningbo - Past Due Invoices.scr.exe	33
PID 2416 wrote to memory of 2864	2416	Ningbo - Past Due Invoices.scr.exe	33
PID 2416 wrote to memory of 2864	2416	Ningbo - Past Due Invoices.scr.exe	33
PID 2416 wrote to memory of 2864	2416	Ningbo - Past Due Invoices.scr.exe	33
PID 2416 wrote to memory of 2764	2416	Ningbo - Past Due Invoices.scr.exe	34
PID 2416 wrote to memory of 2764	2416	Ningbo - Past Due Invoices.scr.exe	34
PID 2416 wrote to memory of 2764	2416	Ningbo - Past Due Invoices.scr.exe	34
PID 2416 wrote to memory of 2764	2416	Ningbo - Past Due Invoices.scr.exe	34
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37
PID 2416 wrote to memory of 2780	2416	Ningbo - Past Due Invoices.scr.exe	37

C:\Users\Admin\AppData\Local\Temp\Ningbo - Past Due Invoices.scr.exe
"C:\Users\Admin\AppData\Local\Temp\Ningbo - Past Due Invoices.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ningbo - Past Due Invoices.scr.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jzARpPDhrks.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jzARpPDhrks" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5CB.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5CB.tmp

Filesize
1KB

MD5
5b7d26175fde6be7bc27cf6b22a64052

SHA1
a57c06d599cf2fcc1a44ba68a1908d6bdb4f1c7e

SHA256
9b2409c82a486398eddb683ffc1ebf2ed506ea672474a9c65bf8962bf156c21c

SHA512
d560470e8c90e17d29c942b329b763c969d4e4642a5f493381ea0505f05212e608379a250f72f49692d0762603448809cc62546ab563091b95fed44898c567bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q46OF6NKYZPFSYT3U5KO.temp

Filesize
7KB

MD5
7e8b504f663054e7a7acee6ba294a27e

SHA1
a4cd0fb38a7734db1d604572f10a795174328b7a

SHA256
23231ea952e68595d72134307ec39987451469541bf130c7a59a9cef6723641c

SHA512
580cb2178509e9c63efadd76624daf0a634ea809483dba5cb09646df6c63fb226ef59c73640f1e5a2011d70025e5a2e582f681c16221403fb0ff160ee95b2924

Download Submit
memory/2416-4-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-3-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download
memory/2416-0-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/2416-5-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/2416-6-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-7-0x00000000056D0000-0x0000000005752000-memory.dmp

Filesize
520KB

Download
memory/2416-2-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-1-0x0000000000EE0000-0x0000000000F8A000-memory.dmp

Filesize
680KB

Download
memory/2416-33-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2780-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads