agenttesla | 6a617cbc6e41a2e0ab810d412877b47dff0f4e4a4e98f3f92b3041c3ec27652e

General

Target
QUOTATION_REQUEST.exe
Size 1.4MB
Sample201109-e6wre57z2e
SHA256 6a617cbc6e41a2e0ab810d412877b47dff0f4e4a4e98f3f92b3041c3ec27652e
MD5 084191a98803e956b9f5009e96d7a4fe
SHA1 d5fe30bb526d168c62d49dc5a3933ec9742c4c57
SHA512 96ae3f3580386cf38733168cb61711dec33924a38a4a7c5ffda557de6c4f265b248cca3abc29b0accc77918788d1c19597b05e358e64fac4abc3b423b636a80a
MD5 SHA1 SHA512

Score

10^/10

agenttesla nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.sarniotex.com
Port
587
Username
[email protected]
Password
dL@KoFb6

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

AgentTesla Payload 13 IoCs

resource	yara_rule
behavioral2/memory/2488-1-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/2488-11-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-13-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-10-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-14-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-15-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-17-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-19-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-20-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-18-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-16-0x000000000044CD0E-mapping.dmp	family_agenttesla
behavioral2/memory/2488-12-0x000000000044CD0E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3408 set thread context of 2488	3408	QUOTATION_REQUEST.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	2488	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2488	MSBuild.exe
2488	MSBuild.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe
2132	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	MSBuild.exe
Token: SeRestorePrivilege	2132	WerFault.exe
Token: SeBackupPrivilege	2132	WerFault.exe
Token: SeDebugPrivilege	2132	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3408	QUOTATION_REQUEST.exe
3408	QUOTATION_REQUEST.exe
3408	QUOTATION_REQUEST.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3408	QUOTATION_REQUEST.exe
3408	QUOTATION_REQUEST.exe
3408	QUOTATION_REQUEST.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2488	3408	QUOTATION_REQUEST.exe	76
PID 3408 wrote to memory of 2488	3408	QUOTATION_REQUEST.exe	76
PID 3408 wrote to memory of 2488	3408	QUOTATION_REQUEST.exe	76
PID 3408 wrote to memory of 2488	3408	QUOTATION_REQUEST.exe	76
PID 3408 wrote to memory of 2488	3408	QUOTATION_REQUEST.exe	76

C:\Users\Admin\AppData\Local\Temp\QUOTATION_REQUEST.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_REQUEST.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 1460
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-9-0x00000000048C0000-0x00000000048C1000-memory.dmp

Download

memory/2132-22-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Download

memory/2488-5-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/2488-6-0x0000000005090000-0x0000000005091000-memory.dmp

Download

memory/2488-7-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/2488-8-0x0000000005C10000-0x0000000005C11000-memory.dmp

Download

memory/2488-2-0x0000000073780000-0x0000000073E6E000-memory.dmp

Download

memory/2488-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/2488-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads