agenttesla | fa0ac43dbbc556f1f34ec4a98447596ac837034c10edaddc8e4dfb0549b508be

General

Target
MT023POe.exe
Size 1.7MB
Sample201109-w8x1kdfsdx
SHA256 fa0ac43dbbc556f1f34ec4a98447596ac837034c10edaddc8e4dfb0549b508be
MD5 da629ab292b78a386d9a66f17e2d26e9
SHA1 7cf0a62a9e98d531612281214a3f2c298541d670
SHA512 d6f741842aabada63adf198cfc4421a6be20e95646e2d7ad06e0e90480f023ff9f2ab88797c95dc3188e52adc9d9d9dff6f237c611f87750073adbcc736663b5
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 14 IoCs

resource	yara_rule
behavioral2/memory/4080-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/4080-1-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-11-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-10-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-13-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-12-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-14-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-15-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-16-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-17-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-18-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-19-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-20-0x000000000044C94E-mapping.dmp	family_agenttesla
behavioral2/memory/4080-21-0x000000000044C94E-mapping.dmp	family_agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemPropertiesRemote.url	MT023POe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 4080	2432	MT023POe.exe	76

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	4080	WerFault.exe	76

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4080	MSBuild.exe
4080	MSBuild.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2432	MT023POe.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	MSBuild.exe
Token: SeRestorePrivilege	2164	WerFault.exe
Token: SeBackupPrivilege	2164	WerFault.exe
Token: SeDebugPrivilege	2164	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2432	MT023POe.exe
2432	MT023POe.exe
2432	MT023POe.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2432	MT023POe.exe
2432	MT023POe.exe
2432	MT023POe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4080	2432	MT023POe.exe	76
PID 2432 wrote to memory of 4080	2432	MT023POe.exe	76
PID 2432 wrote to memory of 4080	2432	MT023POe.exe	76
PID 2432 wrote to memory of 4080	2432	MT023POe.exe	76

C:\Users\Admin\AppData\Local\Temp\MT023POe.exe
"C:\Users\Admin\AppData\Local\Temp\MT023POe.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1464
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-9-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download

memory/2164-22-0x0000000005790000-0x0000000005791000-memory.dmp

Download

memory/4080-6-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/4080-7-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/4080-8-0x0000000005D70000-0x0000000005D71000-memory.dmp

Download

memory/4080-2-0x00000000732F0000-0x00000000739DE000-memory.dmp

Download

memory/4080-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/4080-5-0x0000000005800000-0x0000000005801000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads