agenttesla | 496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2

General

Target

496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe
Size

735KB
MD5

752c73f34aed5a0e613e46569d7f1e63
SHA1

bfd8a1b7d1cdadd45ca7c63cd3de9568dec701b5
SHA256

496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2
SHA512

0b16fc7ab05014142de060a26aee236f9ba34aae4dec9d5962d6ae544eff361c8561f8d8283ce40bef16c72b778b736dc595eabc461332015f06f4de1c48e7d0
SSDEEP

12288:PadsFtzWYwqiZvwcynamw1Ry3fFKqcw+x8BmEjODCwlHcozjWl6:FzWNqiZ4cytw1otKRwkWxOnX2l

Score

10^/10

agenttesla discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.starmech.net
Port:
587
Username:
[email protected]
Password:
nics123
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe
2820	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\BjTxJte = "C:\\Users\\Admin\\AppData\\Roaming\\BjTxJte\\BjTxJte.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe
1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe
2804	RegSvcs.exe
2804	RegSvcs.exe
2680	powershell.exe
2820	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe
Token: SeDebugPrivilege	2804	RegSvcs.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2804	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2680	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	31
PID 1632 wrote to memory of 2680	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	31
PID 1632 wrote to memory of 2680	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	31
PID 1632 wrote to memory of 2680	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	31
PID 1632 wrote to memory of 2820	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	33
PID 1632 wrote to memory of 2820	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	33
PID 1632 wrote to memory of 2820	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	33
PID 1632 wrote to memory of 2820	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	33
PID 1632 wrote to memory of 3016	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	35
PID 1632 wrote to memory of 3016	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	35
PID 1632 wrote to memory of 3016	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	35
PID 1632 wrote to memory of 3016	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	35
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37
PID 1632 wrote to memory of 2804	1632	496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe	37

C:\Users\Admin\AppData\Local\Temp\496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe
"C:\Users\Admin\AppData\Local\Temp\496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\496183edd167fc6543a66bfc47c6a486eacf7fcafa9149d6d78c590e6d6b3be2.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sSvKKDKzbUP.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sSvKKDKzbUP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1036.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1036.tmp

Filesize
1KB

MD5
3f54ede3466a3eb5e6259c2bfabb7ff5

SHA1
7ce334db69df878733dc72762037f6a90edf5652

SHA256
c61483429520f5a1f11a239f391b58705eae417579ff1e3ee533bf19cc79744e

SHA512
f2d1e9000d02f3d5d682213714960f57b15ed666d33afbb1a3c6f588289b4bd6b527ac12865403e144ba478facd23f2b86e860acc801f6a44fe52943c4ea8687

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
769b86e98d9f8c07fe332e4eaf8fc117

SHA1
bad1adb6de983b7f569de0b9430e1a776ea715ec

SHA256
a71db52e9cd0422357de6daba86ed78addec51855d97e316647d2819ef7e5efb

SHA512
1901ea8243e02ec66428aee736eba7861b1d7a4334eff65724dcc36aefc7b807f25386fb5745daf0879c1434403f8520f9af8a6cf03ede8f6bd247d01a829905

Download Submit
memory/1632-4-0x000000007422E000-0x000000007422F000-memory.dmp

Filesize
4KB

Download
memory/1632-32-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/1632-0-0x000000007422E000-0x000000007422F000-memory.dmp

Filesize
4KB

Download
memory/1632-5-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/1632-6-0x0000000000440000-0x00000000004C6000-memory.dmp

Filesize
536KB

Download
memory/1632-2-0x0000000074220000-0x000000007490E000-memory.dmp

Filesize
6.9MB

Download
memory/1632-1-0x0000000001300000-0x00000000013BE000-memory.dmp

Filesize
760KB

Download
memory/1632-3-0x00000000009F0000-0x0000000000A0E000-memory.dmp

Filesize
120KB

Download
memory/2804-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2804-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads