agenttesla | e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3

General

Target

6fbb325e_by_Libranalysis.exe
Size

895KB
MD5

6fbb325e733601c4047943ab88e73044
SHA1

53fc02f829b6e2136b787d3a16d5ec69d58da7bf
SHA256

e915c55dbb5ec35506d25685a0c1a841b257af3bb30745ec5be6019f9d6e5bb3
SHA512

c1b06f871001004e9a91b27674f31a2b54d20830e3d29a31f644836d88347eb84d09ea2373ef62df1b04d72feb5501f15ce0521cefbad5021fdc6310ecfc905f

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2068-135-0x0000000005960000-0x0000000005E2E000-memory.dmp	family_agenttesla

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/3908-122-0x0000000006630000-0x0000000006651000-memory.dmp	agile_net

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 2 IoCs

Processes:

6fbb325e_by_Libranalysis.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	6fbb325e_by_Libranalysis.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	6fbb325e_by_Libranalysis.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6fbb325e_by_Libranalysis.exe

description pid process target process

PID 3908 set thread context of 2068 3908 6fbb325e_by_Libranalysis.exe 6fbb325e_by_Libranalysis.exe

description	pid	process	target process
PID 3908 set thread context of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe

Drops file in Windows directory 3 IoCs

Processes:

6fbb325e_by_Libranalysis.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	6fbb325e_by_Libranalysis.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	6fbb325e_by_Libranalysis.exe
File opened for modification	C:\Windows\assembly	6fbb325e_by_Libranalysis.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

6fbb325e_by_Libranalysis.exe6fbb325e_by_Libranalysis.exe

pid process

3908 6fbb325e_by_Libranalysis.exe
3908 6fbb325e_by_Libranalysis.exe
2068 6fbb325e_by_Libranalysis.exe
2068 6fbb325e_by_Libranalysis.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6fbb325e_by_Libranalysis.exe6fbb325e_by_Libranalysis.exe

description pid process

Token: SeDebugPrivilege 3908 6fbb325e_by_Libranalysis.exe
Token: SeDebugPrivilege 2068 6fbb325e_by_Libranalysis.exe

pid	process
3908	6fbb325e_by_Libranalysis.exe
3908	6fbb325e_by_Libranalysis.exe
2068	6fbb325e_by_Libranalysis.exe
2068	6fbb325e_by_Libranalysis.exe

description	pid	process
Token: SeDebugPrivilege	3908	6fbb325e_by_Libranalysis.exe
Token: SeDebugPrivilege	2068	6fbb325e_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6fbb325e_by_Libranalysis.exe

description	pid	process	target process
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe
PID 3908 wrote to memory of 2068	3908	6fbb325e_by_Libranalysis.exe	6fbb325e_by_Libranalysis.exe

C:\Users\Admin\AppData\Local\Temp\6fbb325e_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\6fbb325e_by_Libranalysis.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908

C:\Users\Admin\AppData\Local\Temp\6fbb325e_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\6fbb325e_by_Libranalysis.exe"
2⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-128-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2068-137-0x00000000032DA000-0x00000000032DB000-memory.dmp

Filesize
4KB

Download
memory/2068-136-0x00000000032D9000-0x00000000032DA000-memory.dmp

Filesize
4KB

Download
memory/2068-135-0x0000000005960000-0x0000000005E2E000-memory.dmp

Filesize
4.8MB

Download
memory/2068-134-0x00000000032D7000-0x00000000032D9000-memory.dmp

Filesize
8KB

Download
memory/2068-133-0x00000000032D2000-0x00000000032D4000-memory.dmp

Filesize
8KB

Download
memory/2068-132-0x00000000032D1000-0x00000000032D2000-memory.dmp

Filesize
4KB

Download
memory/2068-130-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2068-131-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/2068-129-0x000000000040CCEF-mapping.dmp

Download
memory/3908-120-0x00000000028C0000-0x0000000002952000-memory.dmp

Filesize
584KB

Download
memory/3908-127-0x0000000009390000-0x0000000009391000-memory.dmp

Filesize
4KB

Download
memory/3908-126-0x0000000006DB0000-0x0000000006DBB000-memory.dmp

Filesize
44KB

Download
memory/3908-125-0x00000000028C0000-0x0000000002952000-memory.dmp

Filesize
584KB

Download
memory/3908-124-0x00000000065F0000-0x00000000065F1000-memory.dmp

Filesize
4KB

Download
memory/3908-123-0x0000000006710000-0x0000000006711000-memory.dmp

Filesize
4KB

Download
memory/3908-122-0x0000000006630000-0x0000000006651000-memory.dmp

Filesize
132KB

Download
memory/3908-114-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3908-119-0x00000000058E0000-0x00000000058E1000-memory.dmp

Filesize
4KB

Download
memory/3908-118-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/3908-117-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/3908-116-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads