agenttesla | 3f7e3dd0a5d0ae1fd5e216b360ed459a0304251378cb3818353495b50fef5094

General

Target

IMG_001 IMG_SCAN.JPG.exe
Size

596KB
MD5

045cb3d182ab7b7b92ede2e554ae9398
SHA1

47a33a9ccfbdfa44af54d1a2bccfae1dd4dea428
SHA256

9b3e4327c19bd28f38df34eaceef8611d9268cf95aea1fd2a026b26e57ca5ab4
SHA512

9517c57eee3172d906cab3b5b073904659f676ce305a3368e7cf1a6c621c61d671720ac010f1cd9c54ed7786daca0ab5f08d8811099138f53bbe5e1673f2e1f5

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1652586889:AAH8lHbzvtT4QjX1_-3uSZQlT1RC65TAqMU/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/780-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/780-68-0x000000000043771E-mapping.dmp	family_agenttesla
behavioral1/memory/780-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

IMG_001 IMG_SCAN.JPG.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe"	IMG_001 IMG_SCAN.JPG.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

IMG_001 IMG_SCAN.JPG.exe

description pid process target process

PID 1920 set thread context of 780 1920 IMG_001 IMG_SCAN.JPG.exe IMG_001 IMG_SCAN.JPG.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

IMG_001 IMG_SCAN.JPG.exeIMG_001 IMG_SCAN.JPG.exe

pid process

1920 IMG_001 IMG_SCAN.JPG.exe
1920 IMG_001 IMG_SCAN.JPG.exe
780 IMG_001 IMG_SCAN.JPG.exe
780 IMG_001 IMG_SCAN.JPG.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

IMG_001 IMG_SCAN.JPG.exeIMG_001 IMG_SCAN.JPG.exe

description pid process

Token: SeDebugPrivilege 1920 IMG_001 IMG_SCAN.JPG.exe
Token: SeDebugPrivilege 780 IMG_001 IMG_SCAN.JPG.exe

description	pid	process	target process
PID 1920 set thread context of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe

pid	process
1920	IMG_001 IMG_SCAN.JPG.exe
1920	IMG_001 IMG_SCAN.JPG.exe
780	IMG_001 IMG_SCAN.JPG.exe
780	IMG_001 IMG_SCAN.JPG.exe

description	pid	process
Token: SeDebugPrivilege	1920	IMG_001 IMG_SCAN.JPG.exe
Token: SeDebugPrivilege	780	IMG_001 IMG_SCAN.JPG.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

IMG_001 IMG_SCAN.JPG.exe

description	pid	process	target process
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe
PID 1920 wrote to memory of 780	1920	IMG_001 IMG_SCAN.JPG.exe	IMG_001 IMG_SCAN.JPG.exe

C:\Users\Admin\AppData\Local\Temp\IMG_001 IMG_SCAN.JPG.exe
"C:\Users\Admin\AppData\Local\Temp\IMG_001 IMG_SCAN.JPG.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\IMG_001 IMG_SCAN.JPG.exe
  "C:\Users\Admin\AppData\Local\Temp\IMG_001 IMG_SCAN.JPG.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/780-68-0x000000000043771E-mapping.dmp

Download
memory/780-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/780-71-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/1920-60-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1920-62-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1920-63-0x00000000009D0000-0x00000000009D9000-memory.dmp

Filesize
36KB

Download
memory/1920-64-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1920-65-0x0000000004FA0000-0x0000000005015000-memory.dmp

Filesize
468KB

Download
memory/1920-66-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads