agenttesla | d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3

General

Target

d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe
Size

657KB
MD5

05971e8521240cd588015e689baab4b7
SHA1

1911d514d8e9d3310b2876ee591553250a31f44f
SHA256

d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3
SHA512

01db290b831f6e60efaa8bfeb8bb0e1f1137c7843b29da34f024ee6e4f4b2f341ed4f8f2ed7c1a202a7a99781224bfca8bbaf7479ba23796707fc3d0d9994448
SSDEEP

12288:pOjsJrm2DORelTAeZjqjhazCtH42QWkn5IxQMj7RYLgXeevG3j8bQb:pWsJrm2DO0TvqH42ZLuMj7GEXze3UI

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.iaa-airferight.com
Port:
587
Username:
[email protected]
Password:
BIGNAIRA2024
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe
2756	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2384 set thread context of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe
2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe
2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe
812	RegSvcs.exe
812	RegSvcs.exe
2756	powershell.exe
2704	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe
Token: SeDebugPrivilege	812	RegSvcs.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2704	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	31
PID 2384 wrote to memory of 2704	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	31
PID 2384 wrote to memory of 2704	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	31
PID 2384 wrote to memory of 2704	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	31
PID 2384 wrote to memory of 2756	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	33
PID 2384 wrote to memory of 2756	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	33
PID 2384 wrote to memory of 2756	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	33
PID 2384 wrote to memory of 2756	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	33
PID 2384 wrote to memory of 2828	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	35
PID 2384 wrote to memory of 2828	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	35
PID 2384 wrote to memory of 2828	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	35
PID 2384 wrote to memory of 2828	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	35
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37
PID 2384 wrote to memory of 812	2384	d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe	37

C:\Users\Admin\AppData\Local\Temp\d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe
"C:\Users\Admin\AppData\Local\Temp\d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d71f85d32dd19dd5a0c5ad3b97c3eba3277a5966035970a2c9ea7dd8e23fafa3.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jzARpPDhrks.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jzARpPDhrks" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF8D0.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF8D0.tmp

Filesize
1KB

MD5
5b7d26175fde6be7bc27cf6b22a64052

SHA1
a57c06d599cf2fcc1a44ba68a1908d6bdb4f1c7e

SHA256
9b2409c82a486398eddb683ffc1ebf2ed506ea672474a9c65bf8962bf156c21c

SHA512
d560470e8c90e17d29c942b329b763c969d4e4642a5f493381ea0505f05212e608379a250f72f49692d0762603448809cc62546ab563091b95fed44898c567bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
844225603cb6bf94d53792be7e640860

SHA1
6dc8f704dbe0bb939bf518e689ff7123df364fa8

SHA256
86f558acfe3956dcf051be2f593c0e85a3dc6eac92662a0fa2b6b66ae5a9b9f2

SHA512
4673b092fda5ec99de87e45d3aebd813c345be9001945f5efd3beee3412532eb5667221ed43143cab5d9b07729fa04a3d74e9b49ea7a013dbc3c46d1e6998e72

Download Submit
memory/812-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/812-30-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/812-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/812-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/812-31-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/812-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/812-26-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/812-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2384-1-0x00000000011D0000-0x000000000127A000-memory.dmp

Filesize
680KB

Download
memory/2384-2-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2384-0-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

Filesize
4KB

Download
memory/2384-7-0x00000000056A0000-0x0000000005722000-memory.dmp

Filesize
520KB

Download
memory/2384-6-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2384-3-0x0000000000610000-0x0000000000622000-memory.dmp

Filesize
72KB

Download
memory/2384-5-0x0000000073F8E000-0x0000000073F8F000-memory.dmp

Filesize
4KB

Download
memory/2384-4-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download
memory/2384-32-0x0000000073F80000-0x000000007466E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads