agenttesla | aa8858f450d41fa1c9bade302c7d5f008f5abdb54cc3c048df93fdbfc8d24b07

General

Target
PR#68478.exe
Size 1.8MB
Sample201109-pvfc59l71s
SHA256 aa8858f450d41fa1c9bade302c7d5f008f5abdb54cc3c048df93fdbfc8d24b07
MD5 2c040ef11836d62addc57d7074df27f4
SHA1 81412c3839c40c714fce85bcc9f0ccce0c3100f3
SHA512 fce315b56d0b526cf952bdb6f2ac2e85273698335f18f261987a3a79ae9cd3eb0fb3bbdc343a27b9878bdcc57f21a945bc6728d088b703ef820a113155ce5359
MD5 SHA1 SHA512

Score

10^/10

agenttesla nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.dressmartintl.com
Port
587
Username
[email protected]
Password
Dress@2020

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

AgentTesla Payload 13 IoCs

resource	yara_rule
behavioral2/memory/3060-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/3060-1-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-12-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-11-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-13-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-14-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-15-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-16-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-17-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-18-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-19-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-21-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/3060-20-0x000000000044C22E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 3060	4040	PR#68478.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
400	3060	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3060	MSBuild.exe
3060	MSBuild.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe
400	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4040	PR#68478.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	MSBuild.exe
Token: SeRestorePrivilege	400	WerFault.exe
Token: SeBackupPrivilege	400	WerFault.exe
Token: SeDebugPrivilege	400	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4040	PR#68478.exe
4040	PR#68478.exe
4040	PR#68478.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4040	PR#68478.exe
4040	PR#68478.exe
4040	PR#68478.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3060	4040	PR#68478.exe	78
PID 4040 wrote to memory of 3060	4040	PR#68478.exe	78
PID 4040 wrote to memory of 3060	4040	PR#68478.exe	78
PID 4040 wrote to memory of 3060	4040	PR#68478.exe	78
PID 3060 wrote to memory of 1176	3060	MSBuild.exe	79
PID 3060 wrote to memory of 1176	3060	MSBuild.exe	79
PID 3060 wrote to memory of 1176	3060	MSBuild.exe	79

C:\Users\Admin\AppData\Local\Temp\PR#68478.exe
"C:\Users\Admin\AppData\Local\Temp\PR#68478.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:1176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1484
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-22-0x00000000054C0000-0x00000000054C1000-memory.dmp

Download

memory/400-10-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/3060-7-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/3060-8-0x0000000005C90000-0x0000000005C91000-memory.dmp

Download

memory/3060-5-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/3060-2-0x0000000072D50000-0x000000007343E000-memory.dmp

Download

memory/3060-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/3060-6-0x0000000005140000-0x0000000005141000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads