agenttesla | 97154f2cbacc788931f41870273fec97ed2d8790fb543f8f10cfdacd4f04ede4

General

Target

Order From Supplier No. 1820.exe
Size

512KB
MD5

326cd5a007dbc0fbac9ce269353bd696
SHA1

91d4ec9b22df6cd2368d23b95fb8cdae797f8c60
SHA256

97154f2cbacc788931f41870273fec97ed2d8790fb543f8f10cfdacd4f04ede4
SHA512

ae03d7054743f1a77855dfd7c829dac279feeea486f654daa551076fdd1f4dbca38c12b3ddc1934339b2970011289993bf0fba3765c9ac873369feb4aa400535

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.pharco--corp.com
Port:
587
Username:
saleh.mohamed@pharco--corp.com
Password:
aesKbbJWw0

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/944-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/944-14-0x00000000004374EE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Order From Supplier No. 1820.exe

description pid process target process

PID 1048 set thread context of 944 1048 Order From Supplier No. 1820.exe Order From Supplier No. 1820.exe

description	pid	process	target process
PID 1048 set thread context of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Order From Supplier No. 1820.exeOrder From Supplier No. 1820.exe

pid	process
1048	Order From Supplier No. 1820.exe
1048	Order From Supplier No. 1820.exe
1048	Order From Supplier No. 1820.exe
944	Order From Supplier No. 1820.exe
944	Order From Supplier No. 1820.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order From Supplier No. 1820.exeOrder From Supplier No. 1820.exe

description pid process

Token: SeDebugPrivilege 1048 Order From Supplier No. 1820.exe
Token: SeDebugPrivilege 944 Order From Supplier No. 1820.exe

description	pid	process
Token: SeDebugPrivilege	1048	Order From Supplier No. 1820.exe
Token: SeDebugPrivilege	944	Order From Supplier No. 1820.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Order From Supplier No. 1820.exe

description	pid	process	target process
PID 1048 wrote to memory of 3404	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 3404	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 3404	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe
PID 1048 wrote to memory of 944	1048	Order From Supplier No. 1820.exe	Order From Supplier No. 1820.exe

C:\Users\Admin\AppData\Local\Temp\Order From Supplier No. 1820.exe
"C:\Users\Admin\AppData\Local\Temp\Order From Supplier No. 1820.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\Order From Supplier No. 1820.exe
"{path}"
2⤵
PID:3404

C:\Users\Admin\AppData\Local\Temp\Order From Supplier No. 1820.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:944

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order From Supplier No. 1820.exe.log
MD5
3fed8d1dd11972a6e2603bb2d73a3ee5

SHA1
7ecb7f64ade7b91c5815da647e84167c3d95afb4

SHA256
eecf6c0575dc995a485d46a5daaa66f58229e552f16782d873834d218ab17551

SHA512
ca6059eb67f800cc666d5146d24070abf5ee08209f8f9d1668a0ca2201eb3f6fa013c2d807b09925e12b82c37686980fcc26a6a5e4a5ba129c4b2a585961d3bb

Download Submit
memory/944-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/944-23-0x0000000005C90000-0x0000000005C91000-memory.dmp

Filesize
4KB

Download
memory/944-22-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/944-21-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/944-16-0x0000000073460000-0x0000000073B4E000-memory.dmp

Filesize
6.9MB

Download
memory/944-14-0x00000000004374EE-mapping.dmp

Download
memory/1048-7-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/1048-11-0x0000000006560000-0x00000000065C3000-memory.dmp

Filesize
396KB

Download
memory/1048-12-0x0000000007660000-0x0000000007661000-memory.dmp

Filesize
4KB

Download
memory/1048-10-0x0000000006D30000-0x0000000006D44000-memory.dmp

Filesize
80KB

Download
memory/1048-9-0x0000000007130000-0x0000000007131000-memory.dmp

Filesize
4KB

Download
memory/1048-8-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/1048-2-0x0000000073460000-0x0000000073B4E000-memory.dmp

Filesize
6.9MB

Download
memory/1048-6-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/1048-5-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/1048-3-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads