agenttesla | e8d6e647d8611efee71472288c0959d0e7f2950e1bbd226877872de5fc4beeab

Analysis

max time kernel
108s
max time network
99s
platform
windows10_x64
resource
win10v200722
submitted
15/08/2020, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW PURCHASE ORDER FOR AUGUST.exe
Size 660KB
Sample200815-d5bccqc2ln
SHA256 e8d6e647d8611efee71472288c0959d0e7f2950e1bbd226877872de5fc4beeab
MD5 36985f78fc46edf45ccc0f229cdf6564
SHA1 d7ddf8ea33e17a0850e02be9db52d999e2d4353b
SHA512 24aa39e60d27b42bf1a63e8261ef52661ccaeac478237f7b1ed9a6fad2101e7e903a7d931f9e0c26097ceaebd8f855c60cd99faa36b8d3c7c1126cc0e37cd5cd
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.framafilms.com
Port
587
Username
[email protected]
Password
lister11

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1620-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/1620-1-0x000000000044612E-mapping.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\BAVLA = "C:\\Users\\Admin\\AppData\\Roaming\\BAVLA\\BAVLA.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3740 set thread context of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3740	NEW PURCHASE ORDER FOR AUGUST.exe
3740	NEW PURCHASE ORDER FOR AUGUST.exe
3740	NEW PURCHASE ORDER FOR AUGUST.exe
1620	RegSvcs.exe
1620	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	NEW PURCHASE ORDER FOR AUGUST.exe
Token: SeDebugPrivilege	1620	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68
PID 3740 wrote to memory of 1620	3740	NEW PURCHASE ORDER FOR AUGUST.exe	68

C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR AUGUST.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE ORDER FOR AUGUST.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download