agenttesla | 13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5

General

Target
13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe
Size 1.0MB
Sample201125-3e42htkh2j
SHA256 13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5
MD5 a28f16df2ae4cb9ee1473798df5c424e
SHA1 d09b133968bb615544c54f85a465e06c8b057417
SHA512 9341c25fd2057fb1117bd095a4a1452c9834fe7456e686b6c4a72aa4d8f1b341558168aacb715f582073c32bcbea78f1666cd719529b670216f9044a750bf729
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
officepost8

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4220-10-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral2/memory/4220-11-0x00000000004617EE-mapping.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\WNRUXJ = "C:\\Users\\Admin\\AppData\\Roaming\\WNRUXJ\\WNRUXJ.exe"	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4220	InstallUtil.exe
4220	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe
Token: SeDebugPrivilege	4220	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78
PID 4756 wrote to memory of 4220	4756	13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe	78

C:\Users\Admin\AppData\Local\Temp\13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe
"C:\Users\Admin\AppData\Local\Temp\13a34248109d29dee8c2467ad2cebd0acf6712df7db92d8ca7cf9cb21f70eca5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4220-10-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4220-18-0x00000000064A0000-0x00000000064A1000-memory.dmp

Download

memory/4220-17-0x0000000005860000-0x0000000005861000-memory.dmp

Download

memory/4220-12-0x0000000073150000-0x000000007383E000-memory.dmp

Download

memory/4756-4-0x0000000001030000-0x0000000001047000-memory.dmp

Download

memory/4756-7-0x0000000007830000-0x0000000007831000-memory.dmp

Download

memory/4756-8-0x00000000049F0000-0x00000000049FA000-memory.dmp

Download

memory/4756-9-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/4756-6-0x0000000007C50000-0x0000000007C51000-memory.dmp

Download

memory/4756-5-0x0000000004F10000-0x0000000004F2F000-memory.dmp

Download

memory/4756-0-0x0000000073150000-0x000000007383E000-memory.dmp

Download

memory/4756-3-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/4756-1-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads