agenttesla | a4ae21742866df21e5b94b11a9384eb72393c38a8d49fc9fa786298b3a406710

General

Target

003837828.exe
Size

1.4MB
MD5

88c4d1dc3561ecc79ce1805006a46a03
SHA1

c7a4c9e513e22e9dcae05f5e25ccf3b96fb613b3
SHA256

a4ae21742866df21e5b94b11a9384eb72393c38a8d49fc9fa786298b3a406710
SHA512

c29dd21db6789c4de1132b6605be35f4e796cb0aa16cf0f8d7383f0eba49b55decf7cbf516b83b476724fde271a1617f4328cfbea7919acadb7f770cf3a0e432

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.seagull.com.pk
Port:
587
Username:
seagull@seagull.com.pk
Password:
SyeD@1969

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3860-0-0x0000000000800000-0x000000000084C000-memory.dmp	family_agenttesla
behavioral2/memory/3860-1-0x0000000000847B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-8-0x0000000000770000-0x00000000007BC000-memory.dmp	family_agenttesla
behavioral2/memory/4000-9-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-15-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-14-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-16-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-17-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-18-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-19-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-20-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-21-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-22-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-23-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-24-0x00000000007B7B6E-mapping.dmp	family_agenttesla
behavioral2/memory/4000-25-0x00000000007B7B6E-mapping.dmp	family_agenttesla

Drops startup file 1 IoCs

Processes:

003837828.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tabcal.url	003837828.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

003837828.exe

description	pid	process	target process
PID 4012 set thread context of 3860	4012	003837828.exe	MSBuild.exe
PID 4012 set thread context of 4000	4012	003837828.exe	MSBuild.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2164 3860 WerFault.exe MSBuild.exe
2448 4000 WerFault.exe MSBuild.exe

pid	pid_target	process	target process
2164	3860	WerFault.exe	MSBuild.exe
2448	4000	WerFault.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

003837828.exeMSBuild.exeWerFault.exe

pid	process
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4000	MSBuild.exe
4000	MSBuild.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
2448	WerFault.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe
4012	003837828.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

MSBuild.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4000	MSBuild.exe
Token: SeRestorePrivilege	2448	WerFault.exe
Token: SeBackupPrivilege	2448	WerFault.exe
Token: SeDebugPrivilege	2448	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

003837828.exe

pid process

4012 003837828.exe
4012 003837828.exe
4012 003837828.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

003837828.exe

pid process

4012 003837828.exe
4012 003837828.exe
4012 003837828.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

003837828.exe

description	pid	process	target process
PID 4012 wrote to memory of 3860	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 3860	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 3860	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 3860	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 3860	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 4000	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 4000	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 4000	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 4000	4012	003837828.exe	MSBuild.exe
PID 4012 wrote to memory of 4000	4012	003837828.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\003837828.exe
"C:\Users\Admin\AppData\Local\Temp\003837828.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
2⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 24
3⤵
- Program crash
PID:2164

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 1480
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-5-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/2448-13-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/2448-26-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/3860-1-0x0000000000847B6E-mapping.dmp

Download
memory/3860-6-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/3860-0-0x0000000000800000-0x000000000084C000-memory.dmp

Filesize
304KB

Download
memory/4000-17-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-20-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-14-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-16-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-9-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-18-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-19-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-15-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-21-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-22-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-23-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-24-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-25-0x00000000007B7B6E-mapping.dmp

Download
memory/4000-8-0x0000000000770000-0x00000000007BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads