agenttesla | 6cae7d1c457d915e347d1f75b8dbc6523fe4efd80c6e6a3a23a9ff2aeb67a204

General

Target

EPDA Dec 2020 UPDATED_S.O.A Revised.exe

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.shreejilogistix.com
Port:
587
Username:
[email protected]
Password:
ZHNecv9PfHk2

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2756-9-0x0000000004C80000-0x0000000004CCD000-memory.dmp	family_agenttesla
behavioral2/memory/2756-11-0x0000000004F80000-0x0000000004FCC000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

EPDA Dec 2020 UPDATED_S.O.A Revised.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Swely = "C:\\Users\\Public\\Libraries\\ylewS.url"	EPDA Dec 2020 UPDATED_S.O.A Revised.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

EPDA Dec 2020 UPDATED_S.O.A Revised.exe

description pid process target process

PID 4000 set thread context of 2756 4000 EPDA Dec 2020 UPDATED_S.O.A Revised.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

svchost.exe

pid process

2756 svchost.exe
2756 svchost.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeDebugPrivilege 2756 svchost.exe

description	pid	process	target process
PID 4000 set thread context of 2756	4000	EPDA Dec 2020 UPDATED_S.O.A Revised.exe	svchost.exe

pid	process
2756	svchost.exe
2756	svchost.exe

description	pid	process
Token: SeDebugPrivilege	2756	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

EPDA Dec 2020 UPDATED_S.O.A Revised.exe

description	pid	process	target process
PID 4000 wrote to memory of 2756	4000	EPDA Dec 2020 UPDATED_S.O.A Revised.exe	svchost.exe
PID 4000 wrote to memory of 2756	4000	EPDA Dec 2020 UPDATED_S.O.A Revised.exe	svchost.exe
PID 4000 wrote to memory of 2756	4000	EPDA Dec 2020 UPDATED_S.O.A Revised.exe	svchost.exe
PID 4000 wrote to memory of 2756	4000	EPDA Dec 2020 UPDATED_S.O.A Revised.exe	svchost.exe
PID 4000 wrote to memory of 2756	4000	EPDA Dec 2020 UPDATED_S.O.A Revised.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\EPDA Dec 2020 UPDATED_S.O.A Revised.exe
"C:\Users\Admin\AppData\Local\Temp\EPDA Dec 2020 UPDATED_S.O.A Revised.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\System32\svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-9-0x0000000004C80000-0x0000000004CCD000-memory.dmp

Filesize
308KB

Download
memory/2756-4-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2756-5-0x000000000040CD2F-mapping.dmp

Download
memory/2756-6-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/2756-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2756-8-0x0000000073220000-0x000000007390E000-memory.dmp

Filesize
6.9MB

Download
memory/2756-10-0x0000000007E00000-0x0000000007E01000-memory.dmp

Filesize
4KB

Download
memory/2756-11-0x0000000004F80000-0x0000000004FCC000-memory.dmp

Filesize
304KB

Download
memory/2756-13-0x0000000007803000-0x0000000007804000-memory.dmp

Filesize
4KB

Download
memory/2756-12-0x0000000007801000-0x0000000007802000-memory.dmp

Filesize
4KB

Download
memory/2756-14-0x0000000007804000-0x0000000007805000-memory.dmp

Filesize
4KB

Download
memory/2756-15-0x0000000007750000-0x0000000007751000-memory.dmp

Filesize
4KB

Download
memory/4000-2-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads