agenttesla | 0c12ad85d9b46dd1b9923ffd977244fa3a4a46612f38e6edee40fb36d8243ea1

General

Target

datasheet.exe
Size

639KB
MD5

27270bf6a969355e90e16289379cd6d1
SHA1

913f562df18cf266c3ae94605cce6c3ce084d472
SHA256

7292590b86e83ca5c6993b8c56578740d1f066c91baf3d95bee2bd34d9153f15
SHA512

814bec3009c19a298737385b783654110230cf902da1ebf18e2ad697901c884f8cf3f635979659ceedfa17aa5b79aa1b0860316baa2499b589d1586673730780
SSDEEP

12288:O7AgFdeiGKC0uCejzi9UhkL8WYCUeBhQi5UX9aLmmf5jq5XX2sMMnQ4HwXYJ:KAgeizWCeW94WYCnCEmi25H2OQ4QI

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
marcellinus360
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2880 powershell.exe
2772 powershell.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
4 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2880	powershell.exe
2772	powershell.exe

flow	ioc
5	api.ipify.org
4	api.ipify.org

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

datasheet.exepowershell.exepowershell.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	datasheet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2912 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

datasheet.exe

pid process

2696 datasheet.exe
2696 datasheet.exe
2696 datasheet.exe
2696 datasheet.exe
2696 datasheet.exe
2696 datasheet.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

datasheet.exe

description pid process

Token: SeDebugPrivilege 2696 datasheet.exe

pid	process
2912	schtasks.exe

pid	process
2696	datasheet.exe
2696	datasheet.exe
2696	datasheet.exe
2696	datasheet.exe
2696	datasheet.exe
2696	datasheet.exe

description	pid	process
Token: SeDebugPrivilege	2696	datasheet.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

datasheet.exe

description	pid	process	target process
PID 2696 wrote to memory of 2772	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2772	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2772	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2772	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2880	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2880	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2880	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2880	2696	datasheet.exe	powershell.exe
PID 2696 wrote to memory of 2912	2696	datasheet.exe	schtasks.exe
PID 2696 wrote to memory of 2912	2696	datasheet.exe	schtasks.exe
PID 2696 wrote to memory of 2912	2696	datasheet.exe	schtasks.exe
PID 2696 wrote to memory of 2912	2696	datasheet.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\datasheet.exe
"C:\Users\Admin\AppData\Local\Temp\datasheet.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\datasheet.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rjBdvmaV.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:2880
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rjBdvmaV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2710.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2710.tmp

Filesize
1KB

MD5
d438d71b11643e9cfcc8f578a1e06fa3

SHA1
a376d4e52be53fe9623b47e44d5c50764003866e

SHA256
589f6520401522849f56a3bec534b2e40428a2ea5494c79249a1e9b3d761b1e5

SHA512
9fa6b67171f1b205e5374ec4d6f89939b015a2c597bb9feaaacf71bf64d5bd9378ebcd44aa45cd3fcb87c99edcce708ceb7c979d4622027ff5b863adf8031e1b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AXOCYPSJ3ENSFE4T7JX2.temp

Filesize
7KB

MD5
6a7f6fe6fc992f69095d839ff21185cb

SHA1
5c3bf0ca7877a674c6db26253a125864c5cd4f24

SHA256
acb90f5d2e17cfda9b992ddeecedcb089da49561b5c3ee9d81cfa6708d13c622

SHA512
372180ee65a1aa3a89f651b12467b1a49f4d45b26b5a16265c75cb61191cd361687bd9bb353fac1d9ed94ba5841517e17e39a93d2ad9b9e352f998a9cbb4c28a

Download Submit
memory/2636-27-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-20-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-24-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2636-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2636-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2696-4-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-31-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-5-0x0000000005370000-0x00000000053F8000-memory.dmp

Filesize
544KB

Download
memory/2696-0-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/2696-3-0x00000000002D0000-0x00000000002E2000-memory.dmp

Filesize
72KB

Download
memory/2696-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-1-0x0000000000E10000-0x0000000000EB6000-memory.dmp

Filesize
664KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads