agenttesla | 56c86f76934005ff25803fc7b71dfbde700ebe9bec9fa69959c16672fd458e59

General

Target
Revised Order.exe
Size 1.4MB
Sample201109-3jf6e45vbx
SHA256 56c86f76934005ff25803fc7b71dfbde700ebe9bec9fa69959c16672fd458e59
MD5 c846a747027c16f452fb6322de6a20a4
SHA1 00144a852c15d42bc09809f028308334750a828c
SHA512 8e75407172275e2ea17d8653f3bece7ff6da0228f9e959a6014c0c86778ee7ba0b32554cb88de78a03cf56dfd59cf6c71556f2a2dc723d1b22408942e40107b5
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.poongln.com
Port
587
Username
[email protected]
Password
xfLnM!a7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 15 IoCs

resource	yara_rule
behavioral2/memory/1900-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/1900-1-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-12-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-11-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-13-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-14-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-15-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-17-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-16-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-18-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-19-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-20-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-21-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-22-0x000000000044CEBE-mapping.dmp	family_agenttesla
behavioral2/memory/1900-23-0x000000000044CEBE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1144 set thread context of 1900	1144	Revised Order.exe	75

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1460	1900	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1900	MSBuild.exe
1900	MSBuild.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe
1460	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	MSBuild.exe
Token: SeRestorePrivilege	1460	WerFault.exe
Token: SeBackupPrivilege	1460	WerFault.exe
Token: SeDebugPrivilege	1460	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1144	Revised Order.exe
1144	Revised Order.exe
1144	Revised Order.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1144	Revised Order.exe
1144	Revised Order.exe
1144	Revised Order.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1900	1144	Revised Order.exe	75
PID 1144 wrote to memory of 1900	1144	Revised Order.exe	75
PID 1144 wrote to memory of 1900	1144	Revised Order.exe	75
PID 1144 wrote to memory of 1900	1144	Revised Order.exe	75
PID 1144 wrote to memory of 1900	1144	Revised Order.exe	75
PID 1900 wrote to memory of 3676	1900	MSBuild.exe	79
PID 1900 wrote to memory of 3676	1900	MSBuild.exe	79
PID 1900 wrote to memory of 3676	1900	MSBuild.exe	79

C:\Users\Admin\AppData\Local\Temp\Revised Order.exe
"C:\Users\Admin\AppData\Local\Temp\Revised Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 1540
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-10-0x00000000041A0000-0x00000000041A1000-memory.dmp

Download

memory/1460-24-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/1900-5-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/1900-6-0x0000000005470000-0x0000000005471000-memory.dmp

Download

memory/1900-7-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/1900-8-0x0000000006000000-0x0000000006001000-memory.dmp

Download

memory/1900-2-0x0000000073E30000-0x000000007451E000-memory.dmp

Download

memory/1900-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1900-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads