agenttesla | 06fa29bfe88ec7adf47798e9ec98077ae0388e63a1b70f9ec19ca265f93e2e71

General

Target
PO 876543456.exe
Size 1.3MB
Sample201109-h19dlarg7j
SHA256 06fa29bfe88ec7adf47798e9ec98077ae0388e63a1b70f9ec19ca265f93e2e71
MD5 dc0bfd70e2cdc0487601947f404f970a
SHA1 b903ea8848569b32344acf983bc5dfbe542c7d1c
SHA512 bb09513da068d1ade8a69e4947263ab4d023032bf9bbddedd0a61df9f2966da15fb78e971bc8ffae66c2aa9dc173edcafebcfb93f61adf7478215b4dee54cc7d
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
GODISGOOD0147

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 14 IoCs

resource	yara_rule
behavioral2/memory/2708-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/2708-1-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-11-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-10-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-12-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-14-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-15-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-16-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-18-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-17-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-19-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-20-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-13-0x0000000000447A9E-mapping.dmp	family_agenttesla
behavioral2/memory/2708-21-0x0000000000447A9E-mapping.dmp	family_agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bitsadmin.url	PO 876543456.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 796 set thread context of 2708	796	PO 876543456.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	2708	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2708	MSBuild.exe
2708	MSBuild.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe
2576	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	MSBuild.exe
Token: SeRestorePrivilege	2576	WerFault.exe
Token: SeBackupPrivilege	2576	WerFault.exe
Token: SeDebugPrivilege	2576	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
796	PO 876543456.exe
796	PO 876543456.exe
796	PO 876543456.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
796	PO 876543456.exe
796	PO 876543456.exe
796	PO 876543456.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2708	796	PO 876543456.exe	78
PID 796 wrote to memory of 2708	796	PO 876543456.exe	78
PID 796 wrote to memory of 2708	796	PO 876543456.exe	78
PID 796 wrote to memory of 2708	796	PO 876543456.exe	78
PID 796 wrote to memory of 2708	796	PO 876543456.exe	78

C:\Users\Admin\AppData\Local\Temp\PO 876543456.exe
"C:\Users\Admin\AppData\Local\Temp\PO 876543456.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 1428
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2576-9-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/2576-22-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/2708-5-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/2708-6-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/2708-7-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/2708-8-0x0000000005A90000-0x0000000005A91000-memory.dmp

Download

memory/2708-2-0x0000000073B20000-0x000000007420E000-memory.dmp

Download

memory/2708-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2708-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads