agenttesla | 5a31aebe8d849348df31616a406d024dfc43a6c39187640d05c06f4a4d72887b

Analysis

max time kernel
148s
max time network
149s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Disc FDBC 3660.exe
Size

566KB
MD5

943270627e8eb4b1567dc76a6a9196fc
SHA1

592dc27309861b4ef99e122fe63293010dc7d812
SHA256

5a31aebe8d849348df31616a406d024dfc43a6c39187640d05c06f4a4d72887b
SHA512

bbdd498ad4e43372706acb94e9a780114ee85cd86172da9194e8710a8083663268ef2b878f3fe1b089330a386d648b76446d07dcea4b0df8062ccc7300f3d9ab

Score

10^/10

spyware keylogger trojan stealer agenttesla

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.coolgirlsnation.com
Port:
25
Username:
[email protected]
Password:
Qwerty123@

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Disc FDBC 3660.exe

pid	Process
2460	Disc FDBC 3660.exe
2460	Disc FDBC 3660.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Disc FDBC 3660.exe

pid	Process
2460	Disc FDBC 3660.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Disc FDBC 3660.exe

description	pid	Process	procid_target
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71
PID 3008 wrote to memory of 2460	3008	Disc FDBC 3660.exe	71

Suspicious use of SetThreadContext 1 IoCs

Processes:

Disc FDBC 3660.exe

description	pid	Process	procid_target
PID 3008 set thread context of 2460	3008	Disc FDBC 3660.exe	71

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Disc FDBC 3660.exe

description	pid	Process
Token: SeDebugPrivilege	2460	Disc FDBC 3660.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\Disc FDBC 3660.exe
"C:\Users\Admin\AppData\Local\Temp\Disc FDBC 3660.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3008
- C:\Users\Admin\AppData\Local\Temp\Disc FDBC 3660.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of AdjustPrivilegeToken
  PID:2460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Disc FDBC 3660.exe.log

Download Submit
memory/2460-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2460-1-0x000000000044722E-mapping.dmp

Download