agenttesla | 7e63cf4338ffe40dbc4265c56ce8f5510bfa63665a5601b08cbd72700ff671ad

General

Target

DATASHEET.exe
Size

683KB
MD5

c75e23e42ef5a5df0c9e6a3dac5b6288
SHA1

7893b4c8af41995dd0ec3b29ef64c1ceb9df1d6d
SHA256

d21bdb41cbc3370a43458cb6002a0b1a7d1916fc1b5867c87f68d224b6a1555c
SHA512

cf3ba709924ccfca0c936b28020e44250a82d0c6965960358399826d0f473ba2c5bed027cb5e5ee81b311fd47ae09373089b63056b98de3a533d663f053fd399
SSDEEP

12288:0IipgFGd/w3uEjlcsl5WcP6oEfsB206JSE6Mfo+zli:0IPy1ZsqcO8TDMfB

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
graceofgod@amen
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2968	powershell.exe
2956	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 108 set thread context of 2704	108	DATASHEET.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DATASHEET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
108	DATASHEET.exe
108	DATASHEET.exe
108	DATASHEET.exe
108	DATASHEET.exe
108	DATASHEET.exe
108	DATASHEET.exe
108	DATASHEET.exe
2704	RegSvcs.exe
2704	RegSvcs.exe
2968	powershell.exe
2956	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	108	DATASHEET.exe
Token: SeDebugPrivilege	2704	RegSvcs.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2704	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 2968	108	DATASHEET.exe	29
PID 108 wrote to memory of 2968	108	DATASHEET.exe	29
PID 108 wrote to memory of 2968	108	DATASHEET.exe	29
PID 108 wrote to memory of 2968	108	DATASHEET.exe	29
PID 108 wrote to memory of 2956	108	DATASHEET.exe	31
PID 108 wrote to memory of 2956	108	DATASHEET.exe	31
PID 108 wrote to memory of 2956	108	DATASHEET.exe	31
PID 108 wrote to memory of 2956	108	DATASHEET.exe	31
PID 108 wrote to memory of 2560	108	DATASHEET.exe	33
PID 108 wrote to memory of 2560	108	DATASHEET.exe	33
PID 108 wrote to memory of 2560	108	DATASHEET.exe	33
PID 108 wrote to memory of 2560	108	DATASHEET.exe	33
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35
PID 108 wrote to memory of 2704	108	DATASHEET.exe	35

C:\Users\Admin\AppData\Local\Temp\DATASHEET.exe
"C:\Users\Admin\AppData\Local\Temp\DATASHEET.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DATASHEET.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ygpXSDn.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ygpXSDn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp928F.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp928F.tmp

Filesize
1KB

MD5
30b74f8a6cea0bd328ea855cad11056c

SHA1
2dd5d88eaf606cc888887900c91577d54f1b0827

SHA256
cf32d439456015bd7c5ac1b65eb88d153a2ef458fce111b3ac27e8b7c384e8ba

SHA512
783bf08c441a3b3d7f4759a58204f42cdbabe785b57c8004b72dd9dd16d9197295445dac461c87ff863913203decf04eec1aaf30bad32b45a4ddd737d6bda222

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7FIGCQ8Y46H876BASLW6.temp

Filesize
7KB

MD5
43b4013024b5530a481bc077c4f26569

SHA1
096b13c75c039afb4f21c51564831787a2e73809

SHA256
9d32ccf499c144303e87de6c6a1528ea107bb7d858c8d9da8fec7cd9661655c1

SHA512
85a21cacfd3ef8ace3f4eb82731481cebe45c49bb450a010433ce8726d075046a2f5c6bc4ad8726b7aef1b8d6927ae410cb0772ef0df190e370a66b2e96565e1

Download Submit
memory/108-4-0x0000000000910000-0x0000000000922000-memory.dmp

Filesize
72KB

Download
memory/108-3-0x0000000004EA0000-0x0000000004F3E000-memory.dmp

Filesize
632KB

Download
memory/108-0-0x00000000749AE000-0x00000000749AF000-memory.dmp

Filesize
4KB

Download
memory/108-5-0x00000000749AE000-0x00000000749AF000-memory.dmp

Filesize
4KB

Download
memory/108-6-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/108-7-0x0000000005D00000-0x0000000005D86000-memory.dmp

Filesize
536KB

Download
memory/108-2-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/108-1-0x0000000000C40000-0x0000000000CF0000-memory.dmp

Filesize
704KB

Download
memory/108-32-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2704-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2704-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2704-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads