agenttesla | 5994f45fc95b80beb8ef828728bd8248455a7f2c503b025be6991a700ecbbf53

General

Target
G3PKtQPPmMFXB4b.exe
Size 662KB
Sample201217-ft5ncck5bs
SHA256 5994f45fc95b80beb8ef828728bd8248455a7f2c503b025be6991a700ecbbf53
MD5 a1a8d71897fa2160525a6e5deac4b99f
SHA1 a45bcf927345f48943b659d8b483ecb7b8865a9e
SHA512 f7ab686f99d684deec951022c9b863a14d147d4d2e65a586e8b2ccfa0be768a960a29d6a58c352a75a54fc9d5abd11bc605c1c5dda85693b96b0dd773da404be
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.semsmar.com
Port
587
Username
[email protected]
Password
NorthWood11823#

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/748-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/748-8-0x000000000043749E-mapping.dmp	family_agenttesla
behavioral1/memory/748-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/748-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe"	G3PKtQPPmMFXB4b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 748	1036	G3PKtQPPmMFXB4b.exe	32

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1036	G3PKtQPPmMFXB4b.exe
1036	G3PKtQPPmMFXB4b.exe
1036	G3PKtQPPmMFXB4b.exe
1036	G3PKtQPPmMFXB4b.exe
1036	G3PKtQPPmMFXB4b.exe
1036	G3PKtQPPmMFXB4b.exe
748	G3PKtQPPmMFXB4b.exe
748	G3PKtQPPmMFXB4b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	G3PKtQPPmMFXB4b.exe
Token: SeDebugPrivilege	748	G3PKtQPPmMFXB4b.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1744	1036	G3PKtQPPmMFXB4b.exe	29
PID 1036 wrote to memory of 1744	1036	G3PKtQPPmMFXB4b.exe	29
PID 1036 wrote to memory of 1744	1036	G3PKtQPPmMFXB4b.exe	29
PID 1036 wrote to memory of 1744	1036	G3PKtQPPmMFXB4b.exe	29
PID 1036 wrote to memory of 524	1036	G3PKtQPPmMFXB4b.exe	30
PID 1036 wrote to memory of 524	1036	G3PKtQPPmMFXB4b.exe	30
PID 1036 wrote to memory of 524	1036	G3PKtQPPmMFXB4b.exe	30
PID 1036 wrote to memory of 524	1036	G3PKtQPPmMFXB4b.exe	30
PID 1036 wrote to memory of 288	1036	G3PKtQPPmMFXB4b.exe	31
PID 1036 wrote to memory of 288	1036	G3PKtQPPmMFXB4b.exe	31
PID 1036 wrote to memory of 288	1036	G3PKtQPPmMFXB4b.exe	31
PID 1036 wrote to memory of 288	1036	G3PKtQPPmMFXB4b.exe	31
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32
PID 1036 wrote to memory of 748	1036	G3PKtQPPmMFXB4b.exe	32

C:\Users\Admin\AppData\Local\Temp\G3PKtQPPmMFXB4b.exe
"C:\Users\Admin\AppData\Local\Temp\G3PKtQPPmMFXB4b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\G3PKtQPPmMFXB4b.exe
  "{path}"
  2⤵
  PID:1744
- C:\Users\Admin\AppData\Local\Temp\G3PKtQPPmMFXB4b.exe
  "{path}"
  2⤵
  PID:524
- C:\Users\Admin\AppData\Local\Temp\G3PKtQPPmMFXB4b.exe
  "{path}"
  2⤵
  PID:288
- C:\Users\Admin\AppData\Local\Temp\G3PKtQPPmMFXB4b.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/748-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/748-10-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/748-11-0x0000000074900000-0x0000000074FEE000-memory.dmp

Download

memory/1036-2-0x0000000074900000-0x0000000074FEE000-memory.dmp

Download

memory/1036-3-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1036-5-0x0000000000320000-0x0000000000324000-memory.dmp

Download

memory/1036-6-0x0000000007EC0000-0x0000000007F64000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads