agenttesla | 8bd06e8a541a1498bc8a2d44d2212d369214a9cd29bbdb7b802d01e4c1c3fc1f

General

Target
MT024PO.exe
Size 1.5MB
Sample201109-tfasmaab92
SHA256 8bd06e8a541a1498bc8a2d44d2212d369214a9cd29bbdb7b802d01e4c1c3fc1f
MD5 12fce56ad3b4e817b821b42d09e5c113
SHA1 24d6ec4cc412dabc714ee1566bfd6193316bced4
SHA512 c6202843d89d3fdb6d4220ac703c87884dd544fc13e4dfef25b9d7c130e7f55b495ad697e627a211388084461bcdf82892a30d96546982f0d2eeaca6051b5d23
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.ay0ub-sd.com
Port
587
Username
[email protected]
Password
TT@XUf@4

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/576-1-0x0000000000447D9E-mapping.dmp	family_agenttesla
behavioral1/memory/576-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/576-2-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	MSBuild.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fsutil.url	MT024PO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\KTfXUZDt = "C:\\Users\\Admin\\AppData\\Roaming\\aseZpyU\\UWvLJ.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 576	1628	MT024PO.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
576	MSBuild.exe
576	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	576	MSBuild.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1628	MT024PO.exe
1628	MT024PO.exe
1628	MT024PO.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1628	MT024PO.exe
1628	MT024PO.exe
1628	MT024PO.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 576	1628	MT024PO.exe	29
PID 1628 wrote to memory of 576	1628	MT024PO.exe	29
PID 1628 wrote to memory of 576	1628	MT024PO.exe	29
PID 1628 wrote to memory of 576	1628	MT024PO.exe	29
PID 1628 wrote to memory of 576	1628	MT024PO.exe	29
PID 1628 wrote to memory of 576	1628	MT024PO.exe	29

C:\Users\Admin\AppData\Local\Temp\MT024PO.exe
"C:\Users\Admin\AppData\Local\Temp\MT024PO.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/576-2-0x0000000000400000-0x000000000044C000-memory.dmp