agenttesla | 1b86a9e9621de21daee83560ea24dd63af48990e8a910264730be203e1d22dbe

General

Target
COPY OF ORDER.exe
Size 1.6MB
Sample201109-65vpw2bdwj
SHA256 1b86a9e9621de21daee83560ea24dd63af48990e8a910264730be203e1d22dbe
MD5 aab051951b8edb9b4ab193809ebc9e01
SHA1 2dcc789bbe34e8bc1d4434465ec0fe036a8940d2
SHA512 2d0bd85cde72877a4ca1ebdc8b03b43b7327b9095fa8f5acc99f8fb067effc42bcdf1d9584e5dbecc650e25c0aae797b6cf6a381fcdece98b6ffa4e0986aa25a
MD5 SHA1 SHA512

Score

10^/10

agenttesla nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
arvandcorp.icu
Port
587
Username
[email protected]
Password
ImTBZByh9bC5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

AgentTesla Payload 16 IoCs

resource	yara_rule
behavioral2/memory/1016-1-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla
behavioral2/memory/1016-2-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-14-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-18-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-19-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-17-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-15-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-16-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-20-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-13-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-23-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-22-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-24-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-25-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-21-0x000000000044984E-mapping.dmp	family_agenttesla
behavioral2/memory/1016-26-0x000000000044984E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 1016	800	COPY OF ORDER.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2128	1016	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1016	MSBuild.exe
1016	MSBuild.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe
2128	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
800	COPY OF ORDER.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	MSBuild.exe
Token: SeRestorePrivilege	2128	WerFault.exe
Token: SeBackupPrivilege	2128	WerFault.exe
Token: SeDebugPrivilege	2128	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
800	COPY OF ORDER.exe
800	COPY OF ORDER.exe
800	COPY OF ORDER.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
800	COPY OF ORDER.exe
800	COPY OF ORDER.exe
800	COPY OF ORDER.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1016	800	COPY OF ORDER.exe	78
PID 800 wrote to memory of 1016	800	COPY OF ORDER.exe	78
PID 800 wrote to memory of 1016	800	COPY OF ORDER.exe	78
PID 800 wrote to memory of 1016	800	COPY OF ORDER.exe	78

C:\Users\Admin\AppData\Local\Temp\COPY OF ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\COPY OF ORDER.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 1476
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-9-0x0000000005D30000-0x0000000005D31000-memory.dmp

Download

memory/1016-3-0x00000000732C0000-0x00000000739AE000-memory.dmp

Download

memory/1016-6-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/1016-7-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/1016-8-0x0000000005750000-0x0000000005751000-memory.dmp

Download

memory/1016-1-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/2128-11-0x0000000004560000-0x0000000004561000-memory.dmp

Download

memory/2128-10-0x0000000004560000-0x0000000004561000-memory.dmp

Download

memory/2128-27-0x0000000004950000-0x0000000004951000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads