agenttesla | 29890b01a73b6721cf2e80232cc366b95be2eeb81bd7beb72372cd3ae4f05293

General

Target
01_name.exe
Size 101KB
Sample201027-p38ba2ml9n
SHA256 29890b01a73b6721cf2e80232cc366b95be2eeb81bd7beb72372cd3ae4f05293
MD5 4eda80b62167deb5ffe934213c63cc6f
SHA1 58ca74cfa3b643c4bcc3a69d0c2754068515980b
SHA512 8520527161a70dcd676bf5858679f7930f6046ce58ee39b890aea8f745388122461c4303d5118f383ac86402ed50f267eb8a93f0badfac60fd6d9f6541cbf5e8
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.hkcostarn.com
Port
587
Username
[email protected]
Password
result@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\01_name.exe\""	01_name.exe

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2484-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2484-9-0x0000000000437AEE-mapping.dmp	family_agenttesla

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01_name.exe	01_name.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01_name.exe	01_name.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\01_name.exe"	01_name.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\01_name.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\01_name.exe"	01_name.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.ipify.org
22	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3980 set thread context of 2484	3980	01_name.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4088	3980	WerFault.exe	67

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3068	timeout.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3980	01_name.exe
3980	01_name.exe
3980	01_name.exe
2484	regsvcs.exe
2484	regsvcs.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe
4088	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	01_name.exe
Token: SeRestorePrivilege	4088	WerFault.exe
Token: SeBackupPrivilege	4088	WerFault.exe
Token: SeDebugPrivilege	2484	regsvcs.exe
Token: SeDebugPrivilege	4088	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2484	regsvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3068	3980	01_name.exe	73
PID 3980 wrote to memory of 3068	3980	01_name.exe	73
PID 3980 wrote to memory of 3068	3980	01_name.exe	73
PID 3980 wrote to memory of 2484	3980	01_name.exe	79
PID 3980 wrote to memory of 2484	3980	01_name.exe	79
PID 3980 wrote to memory of 2484	3980	01_name.exe	79
PID 3980 wrote to memory of 2484	3980	01_name.exe	79
PID 3980 wrote to memory of 2484	3980	01_name.exe	79
PID 3980 wrote to memory of 2484	3980	01_name.exe	79
PID 3980 wrote to memory of 2484	3980	01_name.exe	79
PID 3980 wrote to memory of 2484	3980	01_name.exe	79

C:\Users\Admin\AppData\Local\Temp\01_name.exe
"C:\Users\Admin\AppData\Local\Temp\01_name.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\timeout.exe
  timeout
  2⤵
  - Delays execution with timeout.exe
  PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 1748
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-24-0x0000000005E80000-0x0000000005E81000-memory.dmp

Download

memory/2484-23-0x0000000005EA0000-0x0000000005EA1000-memory.dmp

Download

memory/2484-22-0x00000000059D0000-0x00000000059D1000-memory.dmp

Download

memory/2484-21-0x0000000005130000-0x0000000005131000-memory.dmp

Download

memory/2484-10-0x0000000073880000-0x0000000073F6E000-memory.dmp

Download

memory/2484-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3980-5-0x0000000006320000-0x0000000006321000-memory.dmp

Download

memory/3980-4-0x00000000059E0000-0x0000000005A6E000-memory.dmp

Download

memory/3980-0-0x0000000073880000-0x0000000073F6E000-memory.dmp

Download

memory/3980-2-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/3980-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

Download

memory/4088-14-0x0000000004600000-0x0000000004601000-memory.dmp

Download

memory/4088-16-0x0000000004F70000-0x0000000004F71000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads