agenttesla | 437d00efdb3e3514135b55fc3574fdf4e109d527f2c998bf614ceb33088effdf

General

Target
new order.exe
Size 1.5MB
Sample201109-mrvdf2hkfx
SHA256 437d00efdb3e3514135b55fc3574fdf4e109d527f2c998bf614ceb33088effdf
MD5 0de18d164e75ab0d3e622ffd37b976f7
SHA1 d02597105fa9333d4c250dbe4bbc661a0f4b7da3
SHA512 d9a95f2360d2e5de3f8f063dcc277e24467ef0fa162757b0efc90376bc288ba77c560e6274fa907838c8259e6e5ab1e2850da793e0890511dcb3aa4de2bad2e2
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.tipusurgical.com
Port
587
Username
[email protected]
Password
ALLAHHOAKBAR786

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 13 IoCs

resource	yara_rule
behavioral2/memory/3984-1-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-0-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral2/memory/3984-10-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-11-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-13-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-12-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-14-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-15-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-16-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-17-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-18-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-20-0x000000000044BB8E-mapping.dmp	family_agenttesla
behavioral2/memory/3984-19-0x000000000044BB8E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 480 set thread context of 3984	480	new order.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4072	3984	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3984	MSBuild.exe
3984	MSBuild.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe
4072	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	MSBuild.exe
Token: SeRestorePrivilege	4072	WerFault.exe
Token: SeBackupPrivilege	4072	WerFault.exe
Token: SeDebugPrivilege	4072	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
480	new order.exe
480	new order.exe
480	new order.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
480	new order.exe
480	new order.exe
480	new order.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 480 wrote to memory of 3984	480	new order.exe	76
PID 480 wrote to memory of 3984	480	new order.exe	76
PID 480 wrote to memory of 3984	480	new order.exe	76
PID 480 wrote to memory of 3984	480	new order.exe	76
PID 480 wrote to memory of 3984	480	new order.exe	76

C:\Users\Admin\AppData\Local\Temp\new order.exe
"C:\Users\Admin\AppData\Local\Temp\new order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 1452
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3984-2-0x0000000073450000-0x0000000073B3E000-memory.dmp

Download

memory/3984-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/3984-5-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Download

memory/3984-6-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/3984-7-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/3984-8-0x0000000006050000-0x0000000006051000-memory.dmp

Download

memory/3984-0-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4072-9-0x00000000046A0000-0x00000000046A1000-memory.dmp

Download

memory/4072-21-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads