agenttesla | da8df4bae3a3ee7500b5de14c09ebf28b2928442c0282d713085efe0fa559b38

General

Target
PO 304161.exe
Size 106KB
Sample201022-8mpycs3c92
SHA256 da8df4bae3a3ee7500b5de14c09ebf28b2928442c0282d713085efe0fa559b38
MD5 2f3934dbe42ecb3474303507fbe15255
SHA1 8165a73df4b886d593985bbfe4185d98b1bbfcc8
SHA512 15446a812a09c6cbc149865aa78873c6a2a2c2f80158882b5108f6643e40becdb2c09bc9e9d206fb38d9a7d93722cb7371f8a90e12d9c8cc9fc161bad8c76217
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.mail.com
Port
587
Username
[email protected]
Password
chikwe22

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2268-8-0x00000000004374BE-mapping.dmp	family_agenttesla
behavioral2/memory/2268-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2168186643-810464528-1121082739-1000\Software\Microsoft\Windows\CurrentVersion\Run\Myapp = "C:\\Users\\Admin\\AppData\\Roaming\\Myapp\\Myapp.exe"	PO 304161.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	api.ipify.org
18	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 512 set thread context of 2268	512	PO 304161.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3672	512	WerFault.exe	66

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4068	timeout.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
512	PO 304161.exe
2268	PO 304161.exe
2268	PO 304161.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	PO 304161.exe
Token: SeDebugPrivilege	2268	PO 304161.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2268	PO 304161.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 4068	512	PO 304161.exe	73
PID 512 wrote to memory of 4068	512	PO 304161.exe	73
PID 512 wrote to memory of 4068	512	PO 304161.exe	73
PID 512 wrote to memory of 1640	512	PO 304161.exe	75
PID 512 wrote to memory of 1640	512	PO 304161.exe	75
PID 512 wrote to memory of 1640	512	PO 304161.exe	75
PID 512 wrote to memory of 2268	512	PO 304161.exe	76
PID 512 wrote to memory of 2268	512	PO 304161.exe	76
PID 512 wrote to memory of 2268	512	PO 304161.exe	76
PID 512 wrote to memory of 2268	512	PO 304161.exe	76
PID 512 wrote to memory of 2268	512	PO 304161.exe	76
PID 512 wrote to memory of 2268	512	PO 304161.exe	76
PID 512 wrote to memory of 2268	512	PO 304161.exe	76
PID 512 wrote to memory of 2268	512	PO 304161.exe	76

C:\Users\Admin\AppData\Local\Temp\PO 304161.exe
"C:\Users\Admin\AppData\Local\Temp\PO 304161.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\timeout.exe
  timeout
  2⤵
  - Delays execution with timeout.exe
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\PO 304161.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 304161.exe"
  2⤵
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\PO 304161.exe
  "C:\Users\Admin\AppData\Local\Temp\PO 304161.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 512 -s 1720
  2⤵
  - Program crash
  PID:3672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/512-6-0x00000000064C0000-0x0000000006506000-memory.dmp

Download

memory/512-0-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/512-2-0x00000000057F0000-0x00000000057F1000-memory.dmp

Download

memory/512-3-0x0000000005390000-0x0000000005391000-memory.dmp

Download

memory/512-4-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

Download

memory/512-1-0x0000000000B50000-0x0000000000B51000-memory.dmp

Download

memory/2268-16-0x0000000005D80000-0x0000000005D81000-memory.dmp

Download

memory/2268-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2268-9-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/2268-15-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Download

memory/2268-18-0x00000000062C0000-0x00000000062C1000-memory.dmp

Download

memory/3672-14-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads