agenttesla | 574f46006cfd1caa512756f6a27e6ce2140124d77f1a979c2c12d0d63652cd5c

Analysis

max time kernel
139s
max time network
144s
platform
windows10_x64
resource
win10v200722
submitted
14/08/2020, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order.exe
Size 939KB
Sample200814-jkyqxy7bme
SHA256 574f46006cfd1caa512756f6a27e6ce2140124d77f1a979c2c12d0d63652cd5c
MD5 e473e0d02609c994b68fbcf14d73698a
SHA1 5a676329d7ccb0a0e06b516553f0e05f4de820ca
SHA512 2d0ca8345095efeebf9def16261360e16dcbaf0b9c60e76be372f5fd5edb337fb935f7ec0c1215370a1a2ca0765e94c6695ae9ca102d7de7fc771c704ba72d82
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 7 IoCs

resource	yara_rule
behavioral2/memory/3836-7-0x0000000000400000-0x000000000046A000-memory.dmp	family_agenttesla
behavioral2/memory/3836-8-0x0000000000454F2E-mapping.dmp	family_agenttesla
behavioral2/memory/3836-13-0x0000000000454F2E-mapping.dmp	family_agenttesla
behavioral2/memory/3836-14-0x0000000000454F2E-mapping.dmp	family_agenttesla
behavioral2/memory/3836-15-0x0000000000454F2E-mapping.dmp	family_agenttesla
behavioral2/memory/3836-16-0x0000000000454F2E-mapping.dmp	family_agenttesla
behavioral2/memory/3836-17-0x0000000000454F2E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3988 set thread context of 3836	3988	order.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3588	3836	WerFault.exe	85

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe
3588	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3588	WerFault.exe
Token: SeBackupPrivilege	3588	WerFault.exe
Token: SeDebugPrivilege	3588	WerFault.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 3656	3984	order.exe	66
PID 3984 wrote to memory of 3656	3984	order.exe	66
PID 3984 wrote to memory of 3656	3984	order.exe	66
PID 3656 wrote to memory of 424	3656	cmd.exe	68
PID 3656 wrote to memory of 424	3656	cmd.exe	68
PID 3656 wrote to memory of 424	3656	cmd.exe	68
PID 3984 wrote to memory of 1144	3984	order.exe	71
PID 3984 wrote to memory of 1144	3984	order.exe	71
PID 3984 wrote to memory of 1144	3984	order.exe	71
PID 3984 wrote to memory of 1228	3984	order.exe	72
PID 3984 wrote to memory of 1228	3984	order.exe	72
PID 3984 wrote to memory of 1228	3984	order.exe	72
PID 1228 wrote to memory of 1576	1228	order.exe	73
PID 1228 wrote to memory of 1576	1228	order.exe	73
PID 1228 wrote to memory of 1576	1228	order.exe	73
PID 1228 wrote to memory of 1636	1228	order.exe	74
PID 1228 wrote to memory of 1636	1228	order.exe	74
PID 1228 wrote to memory of 1636	1228	order.exe	74
PID 1636 wrote to memory of 2364	1636	order.exe	75
PID 1636 wrote to memory of 2364	1636	order.exe	75
PID 1636 wrote to memory of 2364	1636	order.exe	75
PID 1636 wrote to memory of 2352	1636	order.exe	76
PID 1636 wrote to memory of 2352	1636	order.exe	76
PID 1636 wrote to memory of 2352	1636	order.exe	76
PID 2352 wrote to memory of 3868	2352	order.exe	81
PID 2352 wrote to memory of 3868	2352	order.exe	81
PID 2352 wrote to memory of 3868	2352	order.exe	81
PID 2352 wrote to memory of 3880	2352	order.exe	82
PID 2352 wrote to memory of 3880	2352	order.exe	82
PID 2352 wrote to memory of 3880	2352	order.exe	82
PID 3880 wrote to memory of 3976	3880	order.exe	83
PID 3880 wrote to memory of 3976	3880	order.exe	83
PID 3880 wrote to memory of 3976	3880	order.exe	83
PID 3880 wrote to memory of 3988	3880	order.exe	84
PID 3880 wrote to memory of 3988	3880	order.exe	84
PID 3880 wrote to memory of 3988	3880	order.exe	84
PID 3988 wrote to memory of 3836	3988	order.exe	85
PID 3988 wrote to memory of 3836	3988	order.exe	85
PID 3988 wrote to memory of 3836	3988	order.exe	85
PID 3988 wrote to memory of 3836	3988	order.exe	85
PID 3988 wrote to memory of 3836	3988	order.exe	85
PID 3988 wrote to memory of 3836	3988	order.exe	85
PID 3988 wrote to memory of 3836	3988	order.exe	85
PID 3988 wrote to memory of 3836	3988	order.exe	85

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN purchase list /XML "C:\Users\Admin\AppData\Local\Temp\c9b9b8af022a4b269584b794e5506841.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN purchase list /XML "C:\Users\Admin\AppData\Local\Temp\c9b9b8af022a4b269584b794e5506841.xml"
    3⤵
    - Creates scheduled task(s)
    PID:424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\order.exe"
  2⤵
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\order.exe
  "C:\Users\Admin\AppData\Local\Temp\order.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\order.exe"
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\order.exe
    "C:\Users\Admin\AppData\Local\Temp\order.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\order.exe"
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\order.exe
      "C:\Users\Admin\AppData\Local\Temp\order.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        5⤵
        
        PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\order.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        6⤵
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\order.exe"
        7⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 696
        8⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3588-18-0x00000000049E0000-0x00000000049E1000-memory.dmp

Download

memory/3588-12-0x00000000044A0000-0x00000000044A1000-memory.dmp

Download

memory/3836-7-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/3836-9-0x0000000073A70000-0x000000007415E000-memory.dmp

Download