Analysis
-
max time kernel
138s -
max time network
137s -
platform
windows10_x64 -
resource
win10 -
submitted
09-07-2020 12:40
Static task
static1
Behavioral task
behavioral1
Sample
AgentTesla.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
AgentTesla.exe
Resource
win10
General
-
Target
AgentTesla.exe
-
Size
965KB
-
MD5
10888cbc0356d7ed153c9d646e650b67
-
SHA1
fe0d31a7ee4cae23de596186512c6af1310ead4c
-
SHA256
df6e5a970596d544e6f644924cafadda5a596e2337621ea98829bd36801fa02c
-
SHA512
a64b4b9e5525a6c609d1eac830a25d7d95e3ab9b6c9374130728bbdd8ddd492676cb8bb60d39139aadf18e8f7adf715d222b5596d7df601b8317cda78dc335c9
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Program Files\Common Files\System\symsrv.dll acprotect C:\PROGRA~1\COMMON~1\System\symsrv.dll acprotect \Program Files\Common Files\System\symsrv.dll acprotect -
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2312-2-0x00000000005621E0-mapping.dmp family_agenttesla behavioral2/memory/2312-6-0x0000000000400000-0x0000000000564000-memory.dmp family_agenttesla behavioral2/memory/2312-7-0x0000000002AB0000-0x0000000002B5C000-memory.dmp family_agenttesla -
Modifies AppInit DLL entries 2 TTPs
-
Processes:
resource yara_rule \Program Files\Common Files\System\symsrv.dll upx behavioral2/memory/2312-1-0x0000000000400000-0x0000000000564000-memory.dmp upx behavioral2/memory/2312-3-0x0000000000400000-0x0000000000564000-memory.dmp upx C:\PROGRA~1\COMMON~1\System\symsrv.dll upx \Program Files\Common Files\System\symsrv.dll upx behavioral2/memory/2312-6-0x0000000000400000-0x0000000000564000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
AgentTesla.exeAgentTesla.exepid process 792 AgentTesla.exe 2312 AgentTesla.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AgentTesla.exedescription pid process target process PID 792 set thread context of 2312 792 AgentTesla.exe AgentTesla.exe -
Drops file in Program Files directory 1 IoCs
Processes:
AgentTesla.exedescription ioc process File created C:\Program Files\Common Files\System\symsrv.dll AgentTesla.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
AgentTesla.exeAgentTesla.exepid process 792 AgentTesla.exe 792 AgentTesla.exe 2312 AgentTesla.exe 2312 AgentTesla.exe 2312 AgentTesla.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
AgentTesla.exepid process 792 AgentTesla.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AgentTesla.exeAgentTesla.exedescription pid process Token: SeDebugPrivilege 792 AgentTesla.exe Token: SeDebugPrivilege 2312 AgentTesla.exe Token: SeDebugPrivilege 2312 AgentTesla.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
AgentTesla.exedescription pid process target process PID 792 wrote to memory of 2312 792 AgentTesla.exe AgentTesla.exe PID 792 wrote to memory of 2312 792 AgentTesla.exe AgentTesla.exe PID 792 wrote to memory of 2312 792 AgentTesla.exe AgentTesla.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRA~1\COMMON~1\System\symsrv.dllMD5
7574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
\Program Files\Common Files\System\symsrv.dllMD5
7574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
\Program Files\Common Files\System\symsrv.dllMD5
7574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
memory/2312-1-0x0000000000400000-0x0000000000564000-memory.dmpFilesize
1.4MB
-
memory/2312-2-0x00000000005621E0-mapping.dmp
-
memory/2312-3-0x0000000000400000-0x0000000000564000-memory.dmpFilesize
1.4MB
-
memory/2312-6-0x0000000000400000-0x0000000000564000-memory.dmpFilesize
1.4MB
-
memory/2312-7-0x0000000002AB0000-0x0000000002B5C000-memory.dmpFilesize
688KB
-
memory/2312-8-0x0000000002A32000-0x0000000002A33000-memory.dmpFilesize
4KB
-
memory/2312-9-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB