agenttesla | 9194eb682aa76595baf70a6a39240ddd40e1f0fa81aab34c88a70c356f155663

General

Target

PO.exe
Size

1.5MB
MD5

d2b155d39ab9ac0a58e4318c776483aa
SHA1

b6e0a0e790f7224a1634dc6109c79823236d6e5a
SHA256

9194eb682aa76595baf70a6a39240ddd40e1f0fa81aab34c88a70c356f155663
SHA512

357a8263843f3a5d0f9296de48f5bc338809093085db65f2d6b60f70a114c680133ad2822b24c4ba18ec82cb33421064dcbc5e74f6e46eb585a37399038ee0fa

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hybridgroupco.com
Port:
587
Username:
[email protected]
Password:
Obinna123@@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/516-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/516-4-0x00000000004374BE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO.exe

description pid process target process

PID 4772 set thread context of 516 4772 PO.exe PO.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

PO.exePO.exe

pid process

4772 PO.exe
4772 PO.exe
4772 PO.exe
516 PO.exe
516 PO.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO.exePO.exe

description pid process

Token: SeDebugPrivilege 4772 PO.exe
Token: SeDebugPrivilege 516 PO.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PO.exe

pid process

516 PO.exe

description	pid	process	target process
PID 4772 set thread context of 516	4772	PO.exe	PO.exe

pid	process
4772	PO.exe
4772	PO.exe
4772	PO.exe
516	PO.exe
516	PO.exe

description	pid	process
Token: SeDebugPrivilege	4772	PO.exe
Token: SeDebugPrivilege	516	PO.exe

pid	process
516	PO.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PO.exe

description	pid	process	target process
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe
PID 4772 wrote to memory of 516	4772	PO.exe	PO.exe

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772

C:\Users\Admin\AppData\Local\Temp\PO.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:516

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\PO.exe.log
MD5
2ce1b56364fa233e3c3b24c1094c08ef

SHA1
6bd332829aebe567d7b2cb1fd9a82dfe1791052f

SHA256
dcf175d01a6de724456eebafad26562a1c6c59bb61ed4a40675e80b7dbc5680e

SHA512
5abf87138689fdc6f8f79c130c3511c863bac1fb0acc60525bc660c532276e3e0037134a9653e0b4f9a77142236cc18144e90bb40ace7271d6eb57fcf438bfe9

Download Submit
memory/516-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/516-4-0x00000000004374BE-mapping.dmp

Download
memory/516-6-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/516-7-0x00000000012E1000-0x00000000012E2000-memory.dmp

Filesize
4KB

Download
memory/516-8-0x00000000012E2000-0x00000000012E3000-memory.dmp

Filesize
4KB

Download
memory/4772-2-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing