agenttesla | a47758975ed16796d090502afabe317e942f8ae955decb1fc756d43c33c56c11

General

Target

Payment Confirmation Print Out Copy MT103.exe
Size

703KB
MD5

e5cd98a64f8e5107f0f9ce6b90613333
SHA1

1f1677af3f494b8def43775a9077357b756184d7
SHA256

aedfae05284600f51e6fe18a6f47ac68c7971e365d827bed7bc2205f27063c8d
SHA512

e948219debb7790b4ffe26cb9cecd155d2aec1a03a6fd368b49335c25ee24a6805bb3be466dfa099e193630aaec89270368a5294f386c8922e70d616498de024
SSDEEP

12288:yMQiKaxTR1Q8QTAI8vRPc6dWy2HF5VmChmFZKt5HQveM4uHzZNKf5zBnym+FNb/:BQib1qkIGRPc6kvVmTFwt9Qp3KBNym+D

Score

10^/10

agenttesla discovery execution keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.haliza.com.my
Port:
21
Username:
[email protected]
Password:
JesusChrist007$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2348	powershell.exe
2764	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2344 set thread context of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment Confirmation Print Out Copy MT103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payment Confirmation Print Out Copy MT103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2344	Payment Confirmation Print Out Copy MT103.exe
2344	Payment Confirmation Print Out Copy MT103.exe
2192	Payment Confirmation Print Out Copy MT103.exe
2192	Payment Confirmation Print Out Copy MT103.exe
2764	powershell.exe
2348	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	Payment Confirmation Print Out Copy MT103.exe
Token: SeDebugPrivilege	2192	Payment Confirmation Print Out Copy MT103.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2348	2344	Payment Confirmation Print Out Copy MT103.exe	31
PID 2344 wrote to memory of 2348	2344	Payment Confirmation Print Out Copy MT103.exe	31
PID 2344 wrote to memory of 2348	2344	Payment Confirmation Print Out Copy MT103.exe	31
PID 2344 wrote to memory of 2348	2344	Payment Confirmation Print Out Copy MT103.exe	31
PID 2344 wrote to memory of 2764	2344	Payment Confirmation Print Out Copy MT103.exe	33
PID 2344 wrote to memory of 2764	2344	Payment Confirmation Print Out Copy MT103.exe	33
PID 2344 wrote to memory of 2764	2344	Payment Confirmation Print Out Copy MT103.exe	33
PID 2344 wrote to memory of 2764	2344	Payment Confirmation Print Out Copy MT103.exe	33
PID 2344 wrote to memory of 800	2344	Payment Confirmation Print Out Copy MT103.exe	34
PID 2344 wrote to memory of 800	2344	Payment Confirmation Print Out Copy MT103.exe	34
PID 2344 wrote to memory of 800	2344	Payment Confirmation Print Out Copy MT103.exe	34
PID 2344 wrote to memory of 800	2344	Payment Confirmation Print Out Copy MT103.exe	34
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37
PID 2344 wrote to memory of 2192	2344	Payment Confirmation Print Out Copy MT103.exe	37

C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Print Out Copy MT103.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Print Out Copy MT103.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Print Out Copy MT103.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DarniQyyh.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DarniQyyh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD43.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:800
- C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Print Out Copy MT103.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation Print Out Copy MT103.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpFD43.tmp

Filesize
1KB

MD5
5f43fc059c4e280eee8ac34b78cd7bcf

SHA1
503616bd5572ebaf57702937f3715d6ac7d630c5

SHA256
c2818a744f28322beb28557b061597584a012d93c63d1c4fabb0926dcefb4f75

SHA512
9a578c9cac15f722f368c5b01d4db8a2d970ab0eed86245f105a86e21cddb142eb581111823e13352e0ba83c685ca9e98dba22030bc783e3e18f5c915b8bdc01

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
fab20e9bea0a05eb5d7b454085545167

SHA1
4ee988f2f107430628289e6e9780b98410b65b41

SHA256
b594a65d0aed5e8703317b7d62cea1dd5dbecc571cd74f04fe70ab4714513d5e

SHA512
941cd1ff2b26f5962aa098cf16f030551d4d0011b6c1306d6d5baa5a568991c9d4577eda6db562d52627fddc0ce9185c1090d1f073ff3c38bb82df5236784b89

Download Submit
memory/2192-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-25-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2192-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2344-6-0x0000000000F20000-0x0000000000FA8000-memory.dmp

Filesize
544KB

Download
memory/2344-1-0x0000000001130000-0x00000000011E4000-memory.dmp

Filesize
720KB

Download
memory/2344-0-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2344-2-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-3-0x0000000000310000-0x0000000000328000-memory.dmp

Filesize
96KB

Download
memory/2344-5-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2344-4-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Filesize
4KB

Download
memory/2344-32-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads