agenttesla | 7cda85f907b4c3ccfaa685dea286841e56dc5c2895c5d7992398aba433af93bf

General

Target
inquiry_list_market price_00232.pdf.exe
Size 1.4MB
Sample201109-xgm2cdkwhn
SHA256 7cda85f907b4c3ccfaa685dea286841e56dc5c2895c5d7992398aba433af93bf
MD5 73ccbcc1c0e81c69757fcb7cb08fdeac
SHA1 45ef7d8764dc0f3e13faf496ec221bfd6a9ba0b4
SHA512 d579c96cdf75419349d7cd0e574f89569d6bb40b28b7e7cfb891da9b31dcddaeed5b9a07bf37581e27d5cbc3a191e88f5d8378a12d09b8fd3783c6a2b41f6079
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
Smtp.yandex.com
Port
587
Username
[email protected]
Password
ethememir2007

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 14 IoCs

resource	yara_rule
behavioral2/memory/1308-0-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/1308-1-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-11-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-10-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-12-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-14-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-15-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-13-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-16-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-21-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-20-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-19-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-18-0x000000000044C8EE-mapping.dmp	family_agenttesla
behavioral2/memory/1308-17-0x000000000044C8EE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1020 set thread context of 1308	1020	inquiry_list_market price_00232.pdf.exe	78

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1308	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1308	MSBuild.exe
1308	MSBuild.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	MSBuild.exe
Token: SeRestorePrivilege	2064	WerFault.exe
Token: SeBackupPrivilege	2064	WerFault.exe
Token: SeDebugPrivilege	2064	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1020	inquiry_list_market price_00232.pdf.exe
1020	inquiry_list_market price_00232.pdf.exe
1020	inquiry_list_market price_00232.pdf.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1020	inquiry_list_market price_00232.pdf.exe
1020	inquiry_list_market price_00232.pdf.exe
1020	inquiry_list_market price_00232.pdf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1308	1020	inquiry_list_market price_00232.pdf.exe	78
PID 1020 wrote to memory of 1308	1020	inquiry_list_market price_00232.pdf.exe	78
PID 1020 wrote to memory of 1308	1020	inquiry_list_market price_00232.pdf.exe	78
PID 1020 wrote to memory of 1308	1020	inquiry_list_market price_00232.pdf.exe	78
PID 1020 wrote to memory of 1308	1020	inquiry_list_market price_00232.pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\inquiry_list_market price_00232.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\inquiry_list_market price_00232.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 1472
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-2-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Download

memory/1308-3-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1308-5-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/1308-6-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Download

memory/1308-7-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/1308-8-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/1308-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/2064-9-0x0000000004040000-0x0000000004041000-memory.dmp

Download

memory/2064-22-0x00000000048F0000-0x00000000048F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads