agenttesla | fa029f3f149b2c256dd41171fad7844d28eacc04e2c26eaddc7de608824f1910

General

Target
Deliver Note- AWD 20008766543-543939939223232.exe
Size 1.4MB
Sample201109-5bnm673xta
SHA256 fa029f3f149b2c256dd41171fad7844d28eacc04e2c26eaddc7de608824f1910
MD5 6fa946c6b457f2cee6ebe13fbfa54e85
SHA1 085f385c770f23e17d0fb881f614b6b4398ff59d
SHA512 7103b6bf6a5375975efa8d834136b8f1832f5cef24f60b144899c5054a69838c2d06dad43743bd913f6a2517b9e6b7e4f154583210461dd681387b9fc83012e3
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://66.45.232.205/
Port
21
Username
[email protected]
Password
boygirl123456

Credentials

Protocol
ftp
Host
ftp://66.45.232.205/
Port
21
Username
[email protected]
Password
boygirl123456

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1764-1-0x000000000044CD2E-mapping.dmp	family_agenttesla
behavioral1/memory/1764-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1764-2-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1068 set thread context of 1764	1068	Deliver Note- AWD 20008766543-543939939223232.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1764	MSBuild.exe
1764	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1068	Deliver Note- AWD 20008766543-543939939223232.exe
1068	Deliver Note- AWD 20008766543-543939939223232.exe
1068	Deliver Note- AWD 20008766543-543939939223232.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1068	Deliver Note- AWD 20008766543-543939939223232.exe
1068	Deliver Note- AWD 20008766543-543939939223232.exe
1068	Deliver Note- AWD 20008766543-543939939223232.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1764	1068	Deliver Note- AWD 20008766543-543939939223232.exe	29
PID 1068 wrote to memory of 1764	1068	Deliver Note- AWD 20008766543-543939939223232.exe	29
PID 1068 wrote to memory of 1764	1068	Deliver Note- AWD 20008766543-543939939223232.exe	29
PID 1068 wrote to memory of 1764	1068	Deliver Note- AWD 20008766543-543939939223232.exe	29
PID 1068 wrote to memory of 1764	1068	Deliver Note- AWD 20008766543-543939939223232.exe	29
PID 1068 wrote to memory of 1764	1068	Deliver Note- AWD 20008766543-543939939223232.exe	29
PID 1764 wrote to memory of 532	1764	MSBuild.exe	31
PID 1764 wrote to memory of 532	1764	MSBuild.exe	31
PID 1764 wrote to memory of 532	1764	MSBuild.exe	31
PID 1764 wrote to memory of 532	1764	MSBuild.exe	31

C:\Users\Admin\AppData\Local\Temp\Deliver Note- AWD 20008766543-543939939223232.exe
"C:\Users\Admin\AppData\Local\Temp\Deliver Note- AWD 20008766543-543939939223232.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1764-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1764-2-0x0000000000400000-0x0000000000452000-memory.dmp