agenttesla | 8a38416c96cd729c983630873174412ea5a61f140dfd6aaa1e88a6fbaa083002

General

Target
BOQ & SPECIFICATIONS.exe
Size 554KB
Sample200721-aae2tbh3ls
SHA256 8a38416c96cd729c983630873174412ea5a61f140dfd6aaa1e88a6fbaa083002
MD5 9f0eea125c8112fba571e60b1d6f5cb4
SHA1 9aa5431a26956d34499c6418a64f9e93b37dc4ac
SHA512 5799eb2681177a18da50e133083c7a71ee2cec847d87446a1b356a54e039cdd192c6b1d38a880ed47cc60c1b64ef10936c013eda250bbd342cf10b9fc3cbc492
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
challenge12345@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/736-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/736-3-0x000000000044CA9E-mapping.dmp	family_agenttesla
behavioral1/memory/736-4-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/736-5-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\LKUgjc = "C:\\Users\\Admin\\AppData\\Roaming\\LKUgjc\\LKUgjc.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 736	1496	BOQ & SPECIFICATIONS.exe	24

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
736	RegSvcs.exe
736	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 1496 wrote to memory of 736	1496	BOQ & SPECIFICATIONS.exe	24
PID 736 wrote to memory of 1536	736	RegSvcs.exe	28
PID 736 wrote to memory of 1536	736	RegSvcs.exe	28
PID 736 wrote to memory of 1536	736	RegSvcs.exe	28
PID 736 wrote to memory of 1536	736	RegSvcs.exe	28

C:\Users\Admin\AppData\Local\Temp\BOQ & SPECIFICATIONS.exe
"C:\Users\Admin\AppData\Local\Temp\BOQ & SPECIFICATIONS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-2-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/736-4-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/736-5-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads