agenttesla | 5ea66e4e338b5ded7b00ad1575010d7c1149341323a646069f3b00a518f300d5

General

Target

PPPscan87333.scr.exe
Size

745KB
MD5

fa367270d40ada68dd7be9a3ebe2bdf1
SHA1

afd6f7b9822d0d3956e5e055d50451b23481df66
SHA256

5ea66e4e338b5ded7b00ad1575010d7c1149341323a646069f3b00a518f300d5
SHA512

c99c57ced780eead7c7478c0167b855b83dd40c35a2e1e22159c3ae77c2f12e01862fc722249e90c9f5ebd74b5a9e1565205c33094075e91103fdb848c49a510
SSDEEP

12288:oX1nN018HO8PdTXyvFxTPV0gexASJVQ6tb4MjJl9+SoMMBAiK/JSmKRP2crA+XLz:cKOHOaTX+vVhFS7DV4QtdoMViqs/VrAc

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.fosna.net
Port:
21
Username:
[email protected]
Password:
(=8fPSH$KO_!

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1056	powershell.exe
2632	powershell.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 2456	2160	PPPscan87333.scr.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PPPscan87333.scr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PPPscan87333.scr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2456	PPPscan87333.scr.exe
2456	PPPscan87333.scr.exe
1056	powershell.exe
2632	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	PPPscan87333.scr.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1056	2160	PPPscan87333.scr.exe	30
PID 2160 wrote to memory of 1056	2160	PPPscan87333.scr.exe	30
PID 2160 wrote to memory of 1056	2160	PPPscan87333.scr.exe	30
PID 2160 wrote to memory of 1056	2160	PPPscan87333.scr.exe	30
PID 2160 wrote to memory of 2632	2160	PPPscan87333.scr.exe	32
PID 2160 wrote to memory of 2632	2160	PPPscan87333.scr.exe	32
PID 2160 wrote to memory of 2632	2160	PPPscan87333.scr.exe	32
PID 2160 wrote to memory of 2632	2160	PPPscan87333.scr.exe	32
PID 2160 wrote to memory of 3004	2160	PPPscan87333.scr.exe	34
PID 2160 wrote to memory of 3004	2160	PPPscan87333.scr.exe	34
PID 2160 wrote to memory of 3004	2160	PPPscan87333.scr.exe	34
PID 2160 wrote to memory of 3004	2160	PPPscan87333.scr.exe	34
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36
PID 2160 wrote to memory of 2456	2160	PPPscan87333.scr.exe	36

C:\Users\Admin\AppData\Local\Temp\PPPscan87333.scr.exe
"C:\Users\Admin\AppData\Local\Temp\PPPscan87333.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PPPscan87333.scr.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ejRAbgfUflKqo.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ejRAbgfUflKqo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB73E.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3004
- C:\Users\Admin\AppData\Local\Temp\PPPscan87333.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\PPPscan87333.scr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB73E.tmp

Filesize
1KB

MD5
316cc0b23769b06aa977210f52da5629

SHA1
37d25e4545344298155448b5562409b68519041e

SHA256
ceb5170edb5575c51d16008288147d8440921d74f2d3f25826229a86b0b30485

SHA512
972db470d4be24c09ecc41e87139337b7871bd482c41249541f1bb7ac4f98027daeb9fad35c6f0bb638299c37f80c7bfaf0351e91af90db33e043e736ebb7479

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a5c7b8713bbe45c7b8289264701866c0

SHA1
14ab0a7d5f0a9bf8097fdb9134c6e3a4850aa1ad

SHA256
02836527bf3fad3aafa3418794ae0a2a840ae3511c6d4e682f5d9b15c6a16531

SHA512
1b337ed2e6fc2e45b47c9e6e1dd31a1d0a3bd7357512d03f5809fa87503970df524378fe32a1c755afad2c8c10f3adeca483567dfc88c4b28f43fd19dd5bbf7f

Download Submit
memory/2160-4-0x00000000002F0000-0x000000000030E000-memory.dmp

Filesize
120KB

Download
memory/2160-3-0x0000000005140000-0x00000000051F0000-memory.dmp

Filesize
704KB

Download
memory/2160-0-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/2160-5-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/2160-6-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2160-7-0x00000000003E0000-0x0000000000464000-memory.dmp

Filesize
528KB

Download
memory/2160-2-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2160-1-0x0000000000170000-0x000000000022E000-memory.dmp

Filesize
760KB

Download
memory/2160-32-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2456-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2456-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2456-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2456-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2456-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2456-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2456-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2456-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads