agenttesla | eba13078dea9e803b9120a45cd0dfad589f1defdf0f86fe84ae77fe63fff5300

General

Target
2026.224 ORDEN DE COMPRA 00084522184ES DOCS.js
Size 829KB
Sample260529-vrld4aax8x
SHA256 eba13078dea9e803b9120a45cd0dfad589f1defdf0f86fe84ae77fe63fff5300
MD5 201a7d37e296d943a22366325f891404
SHA1 21130d3df3d0833233a01296abbd0955a0a82b24
SHA512 fdc3a8924b14a68eadfd1604f7d6d21b31ff1d56be4f208e274388f2d486b107552e8a5ff6735e9f2ea51f35ba39787c231ec95ece804ebd817f856c2d683e68
SSDEEP 3072:m9S8C00zrNsYvb+NlHgIl+h38UgLwhxwf5RqKfFxZALB4VhyL5lJ0zN9luLlUFSV:702rNvvp
TLSH
T184053A3DCC64412FE173C529C999055FF8825A0B232CEA0754C72B9BAE7398677D329E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection execution agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.hhautoinvestment.co.tz
Port
21
Username
[email protected]
Password
[email protected]&

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2200	powershell.exe
3	2200	powershell.exe
4	2200	powershell.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Environment\UserInitMprLogonScript = "wscript.exe \"C:\\Users\\Admin\\AppData\\Local\\DependingHotmailFirstgov\\ProphetsTroubledYourselvesPitcher.js\""	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2200	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2200	powershell.exe
2200	powershell.exe
2200	powershell.exe
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1032	3564	wscript.exe	80
PID 1032 wrote to memory of 2200	1032	conhost.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\2026.224 ORDEN DE COMPRA 00084522184ES DOCS.js"
1⤵
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless powershell.exe -W H -nOP -nONI -Command "&([scriptblock]::Create($env:sVS8A4njYXDu))"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -W H -nOP -nONI -Command &([scriptblock]::Create($env:sVS8A4njYXDu))
    3⤵
    - Badlisted process makes network request
    - Registers new Windows logon scripts automatically executed at logon.
    - Accesses Microsoft Outlook profiles
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Persistence

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Privilege Escalation

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mnicxgtz.2w2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mnicxgtz.2w2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2200-0-0x0000026ACBD50000-0x0000026ACBD60000-memory.dmp

Download

memory/2200-1-0x0000026ACBD50000-0x0000026ACBD60000-memory.dmp

Download

memory/2200-7-0x0000026AE8000000-0x0000026AE8022000-memory.dmp

Download

memory/2200-9-0x0000026AE8090000-0x0000026AE80F0000-memory.dmp

Download

memory/2200-10-0x0000026AE80F0000-0x0000026AE8104000-memory.dmp

Download

memory/2200-11-0x0000026ACBD50000-0x0000026ACBD60000-memory.dmp

Download

memory/2200-12-0x0000026ACBD50000-0x0000026ACBD60000-memory.dmp

Download

memory/2200-16-0x0000026AE8A90000-0x0000026AE8AD2000-memory.dmp

Download

memory/2200-17-0x0000026AE8B20000-0x0000026AE8B70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads