agenttesla | 733258140e397a26743a3a559b6961324ef07b03291d07699b2b4f4ecc5c8a0b

General

Target
HONEYWELL RFQ.exe
Size 1.4MB
Sample201109-e4848kgdde
SHA256 733258140e397a26743a3a559b6961324ef07b03291d07699b2b4f4ecc5c8a0b
MD5 6389ad387f9c82d8ca43e1040cb65341
SHA1 bd0829eab65a3350c0bd373589d2317e5ea12239
SHA512 c04c09c58eca80355f3f4a84216e744ec36ce2d59a065c17beebcfcb8dee82baf8a516812c987e55592b2c25b68f4c9f3570120021a25af6759aeafb48f4c82d
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.radianthospitals.org
Port
587
Username
[email protected]
Password
ifeanyi12345678

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 13 IoCs

resource	yara_rule
behavioral2/memory/3732-1-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/3732-11-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-10-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-12-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-13-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-14-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-15-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-16-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-17-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-18-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-19-0x000000000044C0AE-mapping.dmp	family_agenttesla
behavioral2/memory/3732-20-0x000000000044C0AE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 644 set thread context of 3732	644	HONEYWELL RFQ.exe	75

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	3732	WerFault.exe	75

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3732	MSBuild.exe
3732	MSBuild.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe
2252	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	MSBuild.exe
Token: SeRestorePrivilege	2252	WerFault.exe
Token: SeBackupPrivilege	2252	WerFault.exe
Token: SeDebugPrivilege	2252	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
644	HONEYWELL RFQ.exe
644	HONEYWELL RFQ.exe
644	HONEYWELL RFQ.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
644	HONEYWELL RFQ.exe
644	HONEYWELL RFQ.exe
644	HONEYWELL RFQ.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3732	644	HONEYWELL RFQ.exe	75
PID 644 wrote to memory of 3732	644	HONEYWELL RFQ.exe	75
PID 644 wrote to memory of 3732	644	HONEYWELL RFQ.exe	75
PID 644 wrote to memory of 3732	644	HONEYWELL RFQ.exe	75
PID 644 wrote to memory of 3732	644	HONEYWELL RFQ.exe	75

C:\Users\Admin\AppData\Local\Temp\HONEYWELL RFQ.exe
"C:\Users\Admin\AppData\Local\Temp\HONEYWELL RFQ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 1432
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2252-9-0x00000000048D0000-0x00000000048D1000-memory.dmp

Download

memory/2252-21-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/3732-5-0x0000000005D20000-0x0000000005D21000-memory.dmp

Download

memory/3732-6-0x0000000005690000-0x0000000005691000-memory.dmp

Download

memory/3732-7-0x0000000005670000-0x0000000005671000-memory.dmp

Download

memory/3732-8-0x0000000006290000-0x0000000006291000-memory.dmp

Download

memory/3732-2-0x0000000073740000-0x0000000073E2E000-memory.dmp

Download

memory/3732-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/3732-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads