agenttesla | 3f354781f665a6a9064df443b5f61f3c0db884d94f14e34fd957b0d7548fa7f0

General

Target

vbc(26).exe
Size

557KB
MD5

5172f944e8874206da2ddbc6959cacb7
SHA1

22958bfde97aaab9e6c844d944104d9ce8140ebf
SHA256

3f354781f665a6a9064df443b5f61f3c0db884d94f14e34fd957b0d7548fa7f0
SHA512

25a2b1063f600e2e65d58f783b64f2ac11b6321da6e4c6f629d795d3443fbec136c973c8bb1871932c8fafa1feb4e16ac028c755c9deb685d5235fe026f5fa27

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
96965648

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1844-2-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1844-3-0x000000000044707E-mapping.dmp	family_agenttesla
behavioral1/memory/1844-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1844-5-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc(26).exe

description pid process target process

PID 376 set thread context of 1844 376 vbc(26).exe vbc(26).exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc(26).exe

pid process

1844 vbc(26).exe
1844 vbc(26).exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc(26).exe

description pid process

Token: SeDebugPrivilege 1844 vbc(26).exe

description	pid	process	target process
PID 376 set thread context of 1844	376	vbc(26).exe	vbc(26).exe

pid	process
1844	vbc(26).exe
1844	vbc(26).exe

description	pid	process
Token: SeDebugPrivilege	1844	vbc(26).exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

vbc(26).exe

description	pid	process	target process
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe
PID 376 wrote to memory of 1844	376	vbc(26).exe	vbc(26).exe

C:\Users\Admin\AppData\Local\Temp\vbc(26).exe
"C:\Users\Admin\AppData\Local\Temp\vbc(26).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:376

C:\Users\Admin\AppData\Local\Temp\vbc(26).exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1844-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-3-0x000000000044707E-mapping.dmp

Download
memory/1844-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1844-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing