agenttesla | 065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d

General

Target

065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
Size

656KB
MD5

8d683edd3682ec02d85549592e56ea84
SHA1

da652d5903583e40d3c357773b3c9b2658ad34d5
SHA256

065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d
SHA512

5c0f19e4f456dfa4591b07bbbca13a3fd2b987e733c4e5632568b46c006d301e169005b8c3ac028175b00ada01215e9915fba8631fc2e1977744ac59a6fa8f0b
SSDEEP

12288:33HI6MePCtBRkfO5bIbs0RffDLUpDQL3QV73rlnbKw0GjA5AyFG:nHIBt/vELffXdgV73rluw0GjA+y

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
graceofgod@amen
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2492	powershell.exe
2884	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
2896	RegSvcs.exe
2896	RegSvcs.exe
2884	powershell.exe
2492	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
Token: SeDebugPrivilege	2896	RegSvcs.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2896	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 2884	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	31
PID 2576 wrote to memory of 2884	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	31
PID 2576 wrote to memory of 2884	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	31
PID 2576 wrote to memory of 2884	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	31
PID 2576 wrote to memory of 2492	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	33
PID 2576 wrote to memory of 2492	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	33
PID 2576 wrote to memory of 2492	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	33
PID 2576 wrote to memory of 2492	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	33
PID 2576 wrote to memory of 2640	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	35
PID 2576 wrote to memory of 2640	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	35
PID 2576 wrote to memory of 2640	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	35
PID 2576 wrote to memory of 2640	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	35
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37
PID 2576 wrote to memory of 2896	2576	065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe	37

C:\Users\Admin\AppData\Local\Temp\065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe
"C:\Users\Admin\AppData\Local\Temp\065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\065241fa6141590605cf478e95314f4ec999320fab79e52083ac73c9b66ccb8d.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kiCYhQDGzRfg.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kiCYhQDGzRfg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A76.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6A76.tmp

Filesize
1KB

MD5
aea88da3ce5de15d0ad44d20edddf0ba

SHA1
e9671e5a7bebc95aa21051b3a43472866e93cdbf

SHA256
40a89510d2f60c9f9e256c5befe5027adcb30387a7f1c0b76d7560ccc1704571

SHA512
acba98bd15bd950cf591b7cd660f77178d1da3f3f74a989a6955e63fa55a6b90b70b7192d45857c7960198f8eabeebf28690ac466e3e25ff82d93c54c7f87a10

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HQPL1ME0V2A65BDDD3XX.temp

Filesize
7KB

MD5
f260da10a5ac9818a69821a982adf740

SHA1
5bc1368e9cc595cb943557652629dd816fea4190

SHA256
243c24bff8b002d2eac698409add1cb5949473c00d18ff066f148f8a6537c927

SHA512
01c2ea54e0a67f0843331f27632657b9927b0bbf96cdbfe036d60fab64b6849d51faff1265a952e7178643f946d4f706509927b39494dddd2598722c0818e70e

Download Submit
memory/2576-4-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2576-31-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2576-5-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-6-0x0000000005130000-0x00000000051B6000-memory.dmp

Filesize
536KB

Download
memory/2576-2-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-1-0x0000000000230000-0x00000000002DA000-memory.dmp

Filesize
680KB

Download
memory/2576-3-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/2896-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2896-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2896-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2896-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2896-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2896-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2896-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads