agenttesla | 2890defa015590771a48e957d5a81dc2f2a6a86b784a8764f135cdd72f0d4e7d

General

Target
Cesión de Créditos.exe
Size 586KB
Sample201109-e61crmw6xa
SHA256 2890defa015590771a48e957d5a81dc2f2a6a86b784a8764f135cdd72f0d4e7d
MD5 b6fdb347eca8545836f866dcc3c3ec81
SHA1 627e32969390cebf42e5d13136cc62c0be8f55b0
SHA512 5df78c54f182254f0489f111245d35c513183f4df7b848510a4c75476dd6f0afef2d8c6dfd74debc295022ad11c33a078268089f5300b4ea3a2e02ca2fa225c4
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.ru
Port
587
Username
[email protected]
Password
Good1234

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1016-5-0x000000000044CEDE-mapping.dmp	family_agenttesla
behavioral1/memory/1016-4-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1016-6-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1016-7-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Cesión de Créditos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Cesión de Créditos.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 1016	1992	Cesión de Créditos.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	InstallUtil.exe
1016	InstallUtil.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1992	Cesión de Créditos.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1992 wrote to memory of 1016	1992	Cesión de Créditos.exe	29
PID 1016 wrote to memory of 704	1016	InstallUtil.exe	31
PID 1016 wrote to memory of 704	1016	InstallUtil.exe	31
PID 1016 wrote to memory of 704	1016	InstallUtil.exe	31
PID 1016 wrote to memory of 704	1016	InstallUtil.exe	31

C:\Users\Admin\AppData\Local\Temp\Cesión de Créditos.exe
"C:\Users\Admin\AppData\Local\Temp\Cesión de Créditos.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-4-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1016-6-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1016-7-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1016-8-0x0000000074BA0000-0x000000007528E000-memory.dmp

Download

memory/1992-0-0x0000000074BA0000-0x000000007528E000-memory.dmp

Download

memory/1992-1-0x00000000008C0000-0x00000000008C1000-memory.dmp

Download

memory/1992-3-0x0000000000AF0000-0x0000000000B41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads