agenttesla | 20ec4be6026cf8acc9166f537ecb3898d0fe4978d4e77dfa135250458b454fdf

General

Target
URGENT QUOTATION (2).exe
Size 342KB
Sample200730-9j2w3cffda
SHA256 20ec4be6026cf8acc9166f537ecb3898d0fe4978d4e77dfa135250458b454fdf
MD5 eba40131697ac2935ef93899c42abfcc
SHA1 a9cf71046cdedfc59f155278b0e0308cf56aa9b7
SHA512 11f745984c630a8128423ef62dff08ffa3578659ca7e507f6bc8571017852afcef5f341b72c1cef6a2649915c54d49689b5ab73ba4ea70957563e097e2979d31
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.travelsapphire.com
Port
587
Username
[email protected]
Password
A7dth4xADt{61

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/572-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/572-1-0x000000000044700E-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 572	2584	URGENT QUOTATION (2).exe	66

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2584	URGENT QUOTATION (2).exe
2584	URGENT QUOTATION (2).exe
572	URGENT QUOTATION (2).exe
572	URGENT QUOTATION (2).exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	URGENT QUOTATION (2).exe
Token: SeDebugPrivilege	572	URGENT QUOTATION (2).exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 572	2584	URGENT QUOTATION (2).exe	66
PID 2584 wrote to memory of 904	2584	URGENT QUOTATION (2).exe	67
PID 2584 wrote to memory of 904	2584	URGENT QUOTATION (2).exe	67
PID 2584 wrote to memory of 904	2584	URGENT QUOTATION (2).exe	67
PID 2584 wrote to memory of 472	2584	URGENT QUOTATION (2).exe	69
PID 2584 wrote to memory of 472	2584	URGENT QUOTATION (2).exe	69
PID 2584 wrote to memory of 472	2584	URGENT QUOTATION (2).exe	69
PID 472 wrote to memory of 1228	472	cmd.exe	71
PID 472 wrote to memory of 1228	472	cmd.exe	71
PID 472 wrote to memory of 1228	472	cmd.exe	71
PID 2584 wrote to memory of 1376	2584	URGENT QUOTATION (2).exe	72
PID 2584 wrote to memory of 1376	2584	URGENT QUOTATION (2).exe	72
PID 2584 wrote to memory of 1376	2584	URGENT QUOTATION (2).exe	72

C:\Users\Admin\AppData\Local\Temp\URGENT QUOTATION (2).exe
"C:\Users\Admin\AppData\Local\Temp\URGENT QUOTATION (2).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Users\Admin\AppData\Local\Temp\URGENT QUOTATION (2).exe
  "C:/Users/Admin/AppData/Local/Temp/URGENT QUOTATION (2).exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/URGENT QUOTATION (2).exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  PID:904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
    3⤵
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - NTFS ADS
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

Analysis

Sharing