agenttesla | 53480d705948121a9bc2c0e0570b85b141b3e2044798f550fe8421fea55d5d70

Resubmissions

29-03-2021 08:32

210329-rvrp1pwdmj 7

26-02-2021 06:53

210226-k4ctkjmxde 10

Analysis

max time kernel
97s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
26-02-2021 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Recibo del envío.exe
Size

1000KB
MD5

30f590b7eac07fe6dc2da82d74cb7f01
SHA1

806e9df9cbe214445752e34f50392b5690209991
SHA256

53480d705948121a9bc2c0e0570b85b141b3e2044798f550fe8421fea55d5d70
SHA512

062d6e0fcda49649ac3fd6e55e6d8f91e7c2d4989219b535ccf0934fd058c9ad98b685de65a2d3c1ec99a77bbc500a705bcf8319d53af8aaf7be6cc0522c5f58

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Recibo del envío.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\file.exe = "C:\\Users\\Admin\\AppData\\Roaming\\file.exe"	Recibo del envío.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Recibo del envío.exe

pid process

1724 Recibo del envío.exe
1724 Recibo del envío.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Recibo del envío.exe

description pid process

Token: SeDebugPrivilege 1724 Recibo del envío.exe

pid	process
1724	Recibo del envío.exe
1724	Recibo del envío.exe

description	pid	process
Token: SeDebugPrivilege	1724	Recibo del envío.exe

C:\Users\Admin\AppData\Local\Temp\Recibo del envío.exe
"C:\Users\Admin\AppData\Local\Temp\Recibo del envío.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-2-0x000007FEF6350000-0x000007FEF6D3C000-memory.dmp

Filesize
9.9MB

Download
memory/1724-3-0x000000013FC80000-0x000000013FC81000-memory.dmp

Filesize
4KB

Download
memory/1724-5-0x0000000002140000-0x0000000002216000-memory.dmp

Filesize
856KB

Download
memory/1724-6-0x000000001AEA0000-0x000000001AEA2000-memory.dmp

Filesize
8KB

Download
memory/1724-7-0x000000001ADB0000-0x000000001AE74000-memory.dmp

Filesize
784KB

Download
memory/1724-9-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/1724-10-0x000000001AEA2000-0x000000001AEA4000-memory.dmp

Filesize
8KB

Download