agenttesla | 112fe86589f5587620a62be8ebeab2ee9898f770762f7be2b92a229c46d52917

General

Target

Payment doc747322.exe
Size

491KB
MD5

88087279864b6d4db153f6dd9c68f065
SHA1

7e8a69d8aecc43d9449af37efb5fcdaee1cf4166
SHA256

112fe86589f5587620a62be8ebeab2ee9898f770762f7be2b92a229c46d52917
SHA512

7c9003242e32bbca7890e0393c370686e3a4011e98e6b3c77859d73d6b97ab89752c1da3c2909bee3ee72333117721f63ecdb856317ebde71cb8ed854c786dfd

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
killdemall007

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
killdemall007

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 17 IoCs

resource	yara_rule
behavioral2/memory/3896-1-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-0-0x0000000000400000-0x000000000046E000-memory.dmp	family_agenttesla
behavioral2/memory/3896-6-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-5-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-7-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-8-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-9-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-10-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-11-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-12-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-13-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-14-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-15-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-16-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-17-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-18-0x000000000046861E-mapping.dmp	family_agenttesla
behavioral2/memory/3896-19-0x000000000046861E-mapping.dmp	family_agenttesla

Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Payment doc747322.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Payment doc747322.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Payment doc747322.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Payment doc747322.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 3896	792	Payment doc747322.exe	69

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
792	Payment doc747322.exe
792	Payment doc747322.exe
3896	Payment doc747322.exe
3896	Payment doc747322.exe
1172	dw20.exe
1172	dw20.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3896	Payment doc747322.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	792	Payment doc747322.exe
Token: SeDebugPrivilege	3896	Payment doc747322.exe
Token: SeRestorePrivilege	1172	dw20.exe
Token: SeBackupPrivilege	1172	dw20.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	68
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	68
PID 792 wrote to memory of 3868	792	Payment doc747322.exe	68
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 792 wrote to memory of 3896	792	Payment doc747322.exe	69
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	76
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	76
PID 3896 wrote to memory of 1172	3896	Payment doc747322.exe	76

C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
"C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
  "{path}"
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\Payment doc747322.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 1876
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1172

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:2296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Credentials in Files

3

T1081

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-20-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/1172-21-0x0000000002A10000-0x0000000002A11000-memory.dmp

Filesize
4KB

Download
memory/1172-4-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/3896-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads