agenttesla | 56f2d6b9b207a2e0f5fc1a59d36376b4cde1ac6ac52e95a9c48c00c02e271516

General

Target

Sinergy_Group Order.exe
Size

661KB
MD5

539201934efaae51a640090736ed472f
SHA1

7e94f7c56e54bb78626d0f4d1c72b2b7d701aca0
SHA256

56f2d6b9b207a2e0f5fc1a59d36376b4cde1ac6ac52e95a9c48c00c02e271516
SHA512

7378b74953bc14b9d18540d34d1872966d0e27572357bf067516f5687a15d442296e16850b02ded3b7ac8e9dadb85b05efd644181e331ac249f77b22ead5a501

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.chigo-cec.com
Port:
587
Username:
[email protected]
Password:
?{jbxkcK53}V

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1880-4-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1880-5-0x0000000000446E9E-mapping.dmp	family_agenttesla
behavioral1/memory/1880-7-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1880-8-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

pid	Process
1880	RegAsm.exe

Loads dropped DLL 2 IoCs

pid	Process
1032	Sinergy_Group Order.exe
1880	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 1880	1032	Sinergy_Group Order.exe	26

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1032	Sinergy_Group Order.exe
1032	Sinergy_Group Order.exe
1032	Sinergy_Group Order.exe
1880	RegAsm.exe
1880	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	Sinergy_Group Order.exe
Token: SeDebugPrivilege	1880	RegAsm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26
PID 1032 wrote to memory of 1880	1032	Sinergy_Group Order.exe	26

C:\Users\Admin\AppData\Local\Temp\Sinergy_Group Order.exe
"C:\Users\Admin\AppData\Local\Temp\Sinergy_Group Order.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-4-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1880-7-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1880-8-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing