agenttesla | 46c6723dba0cf514c72a342d0ed7a53f74b075fb9c2639e48e65ee63bdea4143

General

Target
Swift_Mesaji.exe
Size 1.4MB
Sample201109-srlsrgjkr2
SHA256 46c6723dba0cf514c72a342d0ed7a53f74b075fb9c2639e48e65ee63bdea4143
MD5 62f8e29b354a5cfb2b0c897cbb746f32
SHA1 4973d729b4056c9babc79075ef2eebfe89a6951b
SHA512 13489e44132287ca741a0d34c218895b97c9103e78d2c1cd22cbd7070beb16d6e0fa6326315ff60a6e531ad8c30104c1ed487a8733e4ce119ee84086c0b2e81f
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.dressmartintl.com
Port
587
Username
[email protected]
Password
Dress@2020

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 14 IoCs

resource	yara_rule
behavioral2/memory/2500-1-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/2500-11-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-12-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-13-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-16-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-15-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-17-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-14-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-18-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-19-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-20-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-21-0x000000000044C22E-mapping.dmp	family_agenttesla
behavioral2/memory/2500-22-0x000000000044C22E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 2500	3992	Swift_Mesaji.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	2500	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2500	MSBuild.exe
2500	MSBuild.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe
2084	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	MSBuild.exe
Token: SeRestorePrivilege	2084	WerFault.exe
Token: SeBackupPrivilege	2084	WerFault.exe
Token: SeDebugPrivilege	2084	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3992	Swift_Mesaji.exe
3992	Swift_Mesaji.exe
3992	Swift_Mesaji.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3992	Swift_Mesaji.exe
3992	Swift_Mesaji.exe
3992	Swift_Mesaji.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2500	3992	Swift_Mesaji.exe	76
PID 3992 wrote to memory of 2500	3992	Swift_Mesaji.exe	76
PID 3992 wrote to memory of 2500	3992	Swift_Mesaji.exe	76
PID 3992 wrote to memory of 2500	3992	Swift_Mesaji.exe	76
PID 3992 wrote to memory of 2500	3992	Swift_Mesaji.exe	76
PID 2500 wrote to memory of 3936	2500	MSBuild.exe	80
PID 2500 wrote to memory of 3936	2500	MSBuild.exe	80
PID 2500 wrote to memory of 3936	2500	MSBuild.exe	80

C:\Users\Admin\AppData\Local\Temp\Swift_Mesaji.exe
"C:\Users\Admin\AppData\Local\Temp\Swift_Mesaji.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 1496
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-10-0x00000000050D0000-0x00000000050D1000-memory.dmp

Download

memory/2084-23-0x0000000005800000-0x0000000005801000-memory.dmp

Download

memory/2500-5-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Download

memory/2500-6-0x00000000058F0000-0x00000000058F1000-memory.dmp

Download

memory/2500-7-0x00000000059E0000-0x00000000059E1000-memory.dmp

Download

memory/2500-8-0x0000000006520000-0x0000000006521000-memory.dmp

Download

memory/2500-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/2500-2-0x0000000073260000-0x000000007394E000-memory.dmp

Download

memory/2500-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads