agenttesla | 49930b2de2b5ee0329fb1cd81b52695b30d2bef7bcbac1c5c54725dc524a1a2c

General

Target

JUNE_PAYMENT_2020.exe
Size

931KB
MD5

b0b2a2cb5c962486bec09fce883b8c38
SHA1

9700d4b99aca81cd96decbfee71da5b04a6949df
SHA256

49930b2de2b5ee0329fb1cd81b52695b30d2bef7bcbac1c5c54725dc524a1a2c
SHA512

3ba6aca93a72ff4f1c3cc893c159bae99a234147d96e36f2f5983e1e07d7bc0d884ac7dae3cc74717a31b3d232b8eeed8349f334caa41c77be8084781044f6f1

Score

10^/10

spyware keylogger trojan stealer agenttesla

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

JUNE_PAYMENT_2020.exe

description pid process target process

PID 1400 set thread context of 1432 1400 JUNE_PAYMENT_2020.exe JUNE_PAYMENT_2020.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

JUNE_PAYMENT_2020.exe

description pid process

Token: SeDebugPrivilege 1432 JUNE_PAYMENT_2020.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

JUNE_PAYMENT_2020.exeJUNE_PAYMENT_2020.exe

pid process

1400 JUNE_PAYMENT_2020.exe
1432 JUNE_PAYMENT_2020.exe
1432 JUNE_PAYMENT_2020.exe

description	pid	process	target process
PID 1400 set thread context of 1432	1400	JUNE_PAYMENT_2020.exe	JUNE_PAYMENT_2020.exe

description	pid	process
Token: SeDebugPrivilege	1432	JUNE_PAYMENT_2020.exe

pid	process
1400	JUNE_PAYMENT_2020.exe
1432	JUNE_PAYMENT_2020.exe
1432	JUNE_PAYMENT_2020.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

JUNE_PAYMENT_2020.exe

description	pid	process	target process
PID 1400 wrote to memory of 1432	1400	JUNE_PAYMENT_2020.exe	JUNE_PAYMENT_2020.exe
PID 1400 wrote to memory of 1432	1400	JUNE_PAYMENT_2020.exe	JUNE_PAYMENT_2020.exe
PID 1400 wrote to memory of 1432	1400	JUNE_PAYMENT_2020.exe	JUNE_PAYMENT_2020.exe
PID 1400 wrote to memory of 1432	1400	JUNE_PAYMENT_2020.exe	JUNE_PAYMENT_2020.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

JUNE_PAYMENT_2020.exe

pid process

1400 JUNE_PAYMENT_2020.exe

pid	process
1400	JUNE_PAYMENT_2020.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1432-0-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/1432-2-0x0000000000400000-0x00000000004A6000-memory.dmp	upx
behavioral1/memory/1432-3-0x0000000000400000-0x00000000004A6000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

C:\Users\Admin\AppData\Local\Temp\JUNE_PAYMENT_2020.exe
"C:\Users\Admin\AppData\Local\Temp\JUNE_PAYMENT_2020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1400

C:\Users\Admin\AppData\Local\Temp\JUNE_PAYMENT_2020.exe
"C:\Users\Admin\AppData\Local\Temp\JUNE_PAYMENT_2020.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-0-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1432-1-0x00000000004A3F90-mapping.dmp

Download
memory/1432-2-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1432-3-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/1432-4-0x0000000000370000-0x00000000003BC000-memory.dmp

Filesize
304KB

Download
memory/1432-5-0x0000000001F32000-0x0000000001F33000-memory.dmp

Filesize
4KB

Download
memory/1432-6-0x00000000002A0000-0x00000000002E7000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing