agenttesla | 112fe86589f5587620a62be8ebeab2ee9898f770762f7be2b92a229c46d52917

General

Target

Payment doc747322.exe
Size

491KB
MD5

88087279864b6d4db153f6dd9c68f065
SHA1

7e8a69d8aecc43d9449af37efb5fcdaee1cf4166
SHA256

112fe86589f5587620a62be8ebeab2ee9898f770762f7be2b92a229c46d52917
SHA512

7c9003242e32bbca7890e0393c370686e3a4011e98e6b3c77859d73d6b97ab89752c1da3c2909bee3ee72333117721f63ecdb856317ebde71cb8ed854c786dfd

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
killdemall007

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
killdemall007

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3896-1-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-0-0x0000000000400000-0x000000000046E000-memory.dmp	family_agenttesla
behavioral2/memory/3896-6-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-5-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-7-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-8-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-9-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-10-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-11-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-12-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-13-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-14-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-15-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-16-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-17-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-18-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-19-0x000000000046861E-mapping.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Payment doc747322.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Payment doc747322.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Payment doc747322.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Payment doc747322.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Payment doc747322.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Payment doc747322.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment doc747322.exe

description pid process target process

PID 792 set thread context of 3896 792 Payment doc747322.exe Payment doc747322.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Payment doc747322.exePayment doc747322.exedw20.exe

pid process

792 Payment doc747322.exe
792 Payment doc747322.exe
3896 Payment doc747322.exe
3896 Payment doc747322.exe
1172 dw20.exe
1172 dw20.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Payment doc747322.exe

pid process

3896 Payment doc747322.exe

description	pid	process	target process
PID 792 set thread context of 3896	792	Payment doc747322.exe	Payment doc747322.exe

pid	process
792	Payment doc747322.exe
792	Payment doc747322.exe
3896	Payment doc747322.exe
3896	Payment doc747322.exe
1172	dw20.exe
1172	dw20.exe

pid	process
3896	Payment doc747322.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Payment doc747322.exePayment doc747322.exedw20.exe

description	pid	process
Token: SeDebugPrivilege	792	Payment doc747322.exe
Token: SeDebugPrivilege	3896	Payment doc747322.exe
Token: SeRestorePrivilege	1172	dw20.exe
Token: SeBackupPrivilege	1172	dw20.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Payment doc747322.exePayment doc747322.exe

description	pid	process	target process
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	Payment doc747322.exe
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	dw20.exe
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	dw20.exe
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
"C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
"{path}"
2⤵
PID:3868

C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1876
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:2296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Credentials in Files

3

T1081

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

2

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Payment doc747322.exe.log
MD5
3c257ea23fb2068f749387beb208d8c9

SHA1
f16d295344a455949f9cca28e32c8744893ae7b4

SHA256
6bb131942a2d77e16887bee2a5c2c291c8f96200ba6309746bdece6ebb047e65

SHA512
9e7ed3ca22caab77f372bd39801efe5ce9f1c63fcd3eb363bfedfa691472ef427a775a0d6ad70e6ce38290120a0a24ebcc39e08e5b9979f943eb8208498462ea

Download Submit
memory/1172-20-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/1172-21-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1172-3-0x0000000000000000-mapping.dmp

Download
memory/1172-4-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/3896-10-0x000000000046861E-mapping.dmp

Download
memory/3896-14-0x000000000046861E-mapping.dmp

Download
memory/3896-7-0x000000000046861E-mapping.dmp

Download
memory/3896-8-0x000000000046861E-mapping.dmp

Download
memory/3896-9-0x000000000046861E-mapping.dmp

Download
memory/3896-1-0x000000000046861E-mapping.dmp

Download
memory/3896-11-0x000000000046861E-mapping.dmp

Download
memory/3896-12-0x000000000046861E-mapping.dmp

Download
memory/3896-13-0x000000000046861E-mapping.dmp

Download
memory/3896-5-0x000000000046861E-mapping.dmp

Download
memory/3896-15-0x000000000046861E-mapping.dmp

Download
memory/3896-16-0x000000000046861E-mapping.dmp

Download
memory/3896-17-0x000000000046861E-mapping.dmp

Download
memory/3896-18-0x000000000046861E-mapping.dmp

Download
memory/3896-19-0x000000000046861E-mapping.dmp

Download
memory/3896-6-0x000000000046861E-mapping.dmp

Download
memory/3896-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads