agenttesla | e1cbed7a232593e198fe8e3e687284856dfbbc9ca2863f0901745e64f2186f36

General

Target
wire (5).exe
Size 1.4MB
Sample201109-9efszahe8a
SHA256 e1cbed7a232593e198fe8e3e687284856dfbbc9ca2863f0901745e64f2186f36
MD5 a0965bb015fbfd2014aa9fb0b869ed4a
SHA1 c145ea9422a637f39913338deea5c31529e14c31
SHA512 1548c4ee116ae244c361b3f616ac1a7727f06a375db17d6a8572621f89e1b27b74c4f4cd48d3916365462f47d9b705150105ac19a08a3fc5980edd9a6802037b
MD5 SHA1 SHA512

Score

10^/10

agenttesla nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.mkkarakosemobilya.com
Port
587
Username
[email protected]
Password
MKkkmbly@2019

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

AgentTesla Payload 14 IoCs

resource	yara_rule
behavioral2/memory/3680-145-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-144-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/3680-365-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-366-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-368-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-369-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-367-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-370-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-373-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-372-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-371-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-374-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-378-0x000000000044CA5E-mapping.dmp	family_agenttesla
behavioral2/memory/3680-376-0x000000000044CA5E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1272 set thread context of 3680	1272	wire (5).exe	75

Program crash 1 IoCs

pid	pid_target	Process	procid_target
692	3680	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
3680	MSBuild.exe
3680	MSBuild.exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
692	WerFault.exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	MSBuild.exe
Token: SeRestorePrivilege	692	WerFault.exe
Token: SeBackupPrivilege	692	WerFault.exe
Token: SeDebugPrivilege	692	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1272	wire (5).exe
1272	wire (5).exe
1272	wire (5).exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 3680	1272	wire (5).exe	75
PID 1272 wrote to memory of 3680	1272	wire (5).exe	75
PID 1272 wrote to memory of 3680	1272	wire (5).exe	75
PID 1272 wrote to memory of 3680	1272	wire (5).exe	75
PID 1272 wrote to memory of 3680	1272	wire (5).exe	75

C:\Users\Admin\AppData\Local\Temp\wire (5).exe
"C:\Users\Admin\AppData\Local\Temp\wire (5).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 1492
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-364-0x00000000042F0000-0x00000000042F1000-memory.dmp

Download

memory/692-382-0x0000000004A20000-0x0000000004A21000-memory.dmp

Download

memory/3680-149-0x0000000006000000-0x0000000006001000-memory.dmp

Download

memory/3680-150-0x00000000059C0000-0x00000000059C1000-memory.dmp

Download

memory/3680-151-0x00000000059A0000-0x00000000059A1000-memory.dmp

Download

memory/3680-152-0x0000000006500000-0x0000000006501000-memory.dmp

Download

memory/3680-146-0x0000000073670000-0x0000000073D5E000-memory.dmp

Download

memory/3680-147-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/3680-144-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads