agenttesla | cd5da7605f0fafa3b1b4415e7df169580bb27e5c11e5951f031ee9cb8df1e1ec

General

Target
Order-Required.exe
Size 1.5MB
Sample201109-3th9x54ff2
SHA256 cd5da7605f0fafa3b1b4415e7df169580bb27e5c11e5951f031ee9cb8df1e1ec
MD5 f209610447bc34e6d5413f0a02bee824
SHA1 892932b60d89d9e3a2e060bd7718986216ff74d5
SHA512 30b956a4181baff381cee8576c63c988e7b0c065205de94db9ffc1ed518c5d9c5254f315c8305e37e9902f0b96ba59fcab82db9a41181bb6a87f915c7549735c
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yltab.com
Port
587
Username
[email protected]
Password
VdwhsPd5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3644-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/3644-1-0x000000000044CDAE-mapping.dmp	family_agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dispdiag.url	Order-Required.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\uEtmoKl = "C:\\Users\\Admin\\AppData\\Roaming\\uEtmoKl\\uEtmoKl.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 3644	636	Order-Required.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3644	MSBuild.exe
3644	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3644	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
636	Order-Required.exe
636	Order-Required.exe
636	Order-Required.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
636	Order-Required.exe
636	Order-Required.exe
636	Order-Required.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3644	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3644	636	Order-Required.exe	75
PID 636 wrote to memory of 3644	636	Order-Required.exe	75
PID 636 wrote to memory of 3644	636	Order-Required.exe	75
PID 636 wrote to memory of 3644	636	Order-Required.exe	75
PID 636 wrote to memory of 3644	636	Order-Required.exe	75
PID 3644 wrote to memory of 2580	3644	MSBuild.exe	80
PID 3644 wrote to memory of 2580	3644	MSBuild.exe	80
PID 3644 wrote to memory of 2580	3644	MSBuild.exe	80

C:\Users\Admin\AppData\Local\Temp\Order-Required.exe
"C:\Users\Admin\AppData\Local\Temp\Order-Required.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:2580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Analysis

Sharing