agenttesla | 8100e4e4aec4f7f9ca98d640d2c68bfd47f4f7538c041f33157faf8e924d0a74

General

Target

DOC-4529464927595.exe
Size

964KB
MD5

01727a09b28fe78b2d958ccafe6a1264
SHA1

83036afbf67fac6220141459a1e67a9dc18dc515
SHA256

8100e4e4aec4f7f9ca98d640d2c68bfd47f4f7538c041f33157faf8e924d0a74
SHA512

719f8e9aba1de854c85922f4dfe2f7f7c96f3aa80d4de2ddd4843ff23289468bd232a53382ad41eedbd06c31349704013a6f1fc3998df4339c54d4f74acfb99a

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
Sages101*

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3692-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/3692-1-0x000000000044701E-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

DOC-4529464927595.exe

description pid process target process

PID 720 set thread context of 3692 720 DOC-4529464927595.exe DOC-4529464927595.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DOC-4529464927595.exe

pid process

3692 DOC-4529464927595.exe
3692 DOC-4529464927595.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DOC-4529464927595.exe

description pid process

Token: SeDebugPrivilege 3692 DOC-4529464927595.exe

description	pid	process	target process
PID 720 set thread context of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe

pid	process
3692	DOC-4529464927595.exe
3692	DOC-4529464927595.exe

description	pid	process
Token: SeDebugPrivilege	3692	DOC-4529464927595.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

DOC-4529464927595.exe

description	pid	process	target process
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe
PID 720 wrote to memory of 3692	720	DOC-4529464927595.exe	DOC-4529464927595.exe

C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe
"C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:720

C:\Users\Admin\AppData\Local\Temp\DOC-4529464927595.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\DOC-4529464927595.exe.log
MD5
ef140ef600b2463c9e7dbf064a104046

SHA1
c08fd1853877be95575ea2e860dd8cafef31f54c

SHA256
ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616

SHA512
bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c

Download Submit
memory/3692-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3692-1-0x000000000044701E-mapping.dmp

Download

Analysis

Sharing