agenttesla | ee7842c5dd491f8f79e898854c19a2bdfe06be1bffeaeb4011ae6449b5a43362

General

Target
Offer.exe
Size 594KB
Sample201109-vxmreg6pzn
SHA256 ee7842c5dd491f8f79e898854c19a2bdfe06be1bffeaeb4011ae6449b5a43362
MD5 aebf8ea49075f7fe2017f40c4cdcbd91
SHA1 11b5d4e1f6055e94648ec9b4c3f70ed62d433316
SHA512 e715aa6c762bf0d18611e59583304705029e13a53744b0c051e73401115e57eb10d1c765c116c447a65e207e49272c8ce820c7b5493570177d778fd8567ca411
MD5 SHA1 SHA512

Score

10^/10

Credentials

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2000-1-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/2000-2-0x000000000044CA7E-mapping.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\GpwDk = "C:\\EWYCRADZ\\GpwDkR\\GpwDkRZMy.vbs"	Offer.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Offer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Offer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 652 set thread context of 2000	652	Offer.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	InstallUtil.exe
2000	InstallUtil.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
652	Offer.exe
652	Offer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	InstallUtil.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 788	652	Offer.exe	78
PID 652 wrote to memory of 788	652	Offer.exe	78
PID 652 wrote to memory of 788	652	Offer.exe	78
PID 652 wrote to memory of 2000	652	Offer.exe	79
PID 652 wrote to memory of 2000	652	Offer.exe	79
PID 652 wrote to memory of 2000	652	Offer.exe	79
PID 652 wrote to memory of 2000	652	Offer.exe	79
PID 2000 wrote to memory of 2252	2000	InstallUtil.exe	80
PID 2000 wrote to memory of 2252	2000	InstallUtil.exe	80
PID 2000 wrote to memory of 2252	2000	InstallUtil.exe	80

C:\Users\Admin\AppData\Local\Temp\Offer.exe
"C:\Users\Admin\AppData\Local\Temp\Offer.exe"
1⤵
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
  "C:\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe"
  2⤵
  PID:788
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
  "C:\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:2252