agenttesla | 37b7d1816e5653bf8fc47b2abc51d9fa5168e0574620d89742ef685ea935dc92

General

Target

Port ID A1804-21-300.exe
Size

1.0MB
MD5

bfe66eb91b2e298ba2fd8628a1cac10b
SHA1

cf2835eed2ee9fa25bfaf0849e78282b63659210
SHA256

37b7d1816e5653bf8fc47b2abc51d9fa5168e0574620d89742ef685ea935dc92
SHA512

42360473b535cb4ea6834c32d51ccaaacbe51da6be8d62fec48a54d2314c8155c5b031500ba3f922edb191f0b4e6c818b746206599de01daf1edb1067fd4b89d

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.gammavilla.org
Port:
587
Username:
info@gammavilla.org
Password:
county2018

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/848-7-0x0000000000400000-0x0000000000464000-memory.dmp	family_agenttesla
behavioral1/memory/848-8-0x000000000045FE6E-mapping.dmp	family_agenttesla
behavioral1/memory/848-9-0x0000000000400000-0x0000000000464000-memory.dmp	family_agenttesla
behavioral1/memory/848-10-0x0000000000400000-0x0000000000464000-memory.dmp	family_agenttesla

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Port ID A1804-21-300.exe

description pid process target process

PID 784 set thread context of 848 784 Port ID A1804-21-300.exe Port ID A1804-21-300.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Port ID A1804-21-300.exe

pid process

848 Port ID A1804-21-300.exe
848 Port ID A1804-21-300.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Port ID A1804-21-300.exe

description pid process

Token: SeDebugPrivilege 848 Port ID A1804-21-300.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Port ID A1804-21-300.exe

pid process

848 Port ID A1804-21-300.exe

description	pid	process	target process
PID 784 set thread context of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe

pid	process
848	Port ID A1804-21-300.exe
848	Port ID A1804-21-300.exe

description	pid	process
Token: SeDebugPrivilege	848	Port ID A1804-21-300.exe

pid	process
848	Port ID A1804-21-300.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Port ID A1804-21-300.exe

description	pid	process	target process
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe
PID 784 wrote to memory of 848	784	Port ID A1804-21-300.exe	Port ID A1804-21-300.exe

C:\Users\Admin\AppData\Local\Temp\Port ID A1804-21-300.exe
"C:\Users\Admin\AppData\Local\Temp\Port ID A1804-21-300.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\Port ID A1804-21-300.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:848

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-2-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/784-3-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download
memory/784-5-0x0000000000360000-0x000000000036E000-memory.dmp

Filesize
56KB

Download
memory/784-6-0x0000000005810000-0x00000000058DB000-memory.dmp

Filesize
812KB

Download
memory/848-7-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/848-8-0x000000000045FE6E-mapping.dmp

Download
memory/848-9-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/848-10-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/848-11-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing