agenttesla | fd1dc434508928bc6ebdb5d29de7a1530f64b5d9eb8a9a577f97db741a62a644

Analysis

max time kernel
145s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
08/05/2021, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HBL-20210508 INVOICE.exe
Size 808KB
Sample210508-82273fsnc2
SHA256 fd1dc434508928bc6ebdb5d29de7a1530f64b5d9eb8a9a577f97db741a62a644
MD5 48ec48b480a6a7e168da0d935a1d7aa4
SHA1 3a4a72e84866ca8da0c60505b48a5a530240f2f5
SHA512 63f49ce2580a52109f38d4375efb20a0c21cb47d2c613e9e733454a6cff3b39ae38d6cd944dbbbaa6e7443dbb94615c17785c225e97364ecc1ee82008e2ad151
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.prinutrition.com
Port
587
Username
[email protected]
Password
forrest

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3404-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3404-126-0x000000000043748E-mapping.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\zUbDt = "C:\\Users\\Admin\\AppData\\Roaming\\zUbDt\\zUbDt.exe"	HBL-20210508 INVOICE.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3892 set thread context of 3404	3892	HBL-20210508 INVOICE.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3892	HBL-20210508 INVOICE.exe
3892	HBL-20210508 INVOICE.exe
3404	HBL-20210508 INVOICE.exe
3404	HBL-20210508 INVOICE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	HBL-20210508 INVOICE.exe
Token: SeDebugPrivilege	3404	HBL-20210508 INVOICE.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 2208	3892	HBL-20210508 INVOICE.exe	79
PID 3892 wrote to memory of 2208	3892	HBL-20210508 INVOICE.exe	79
PID 3892 wrote to memory of 2208	3892	HBL-20210508 INVOICE.exe	79
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80
PID 3892 wrote to memory of 3404	3892	HBL-20210508 INVOICE.exe	80

C:\Users\Admin\AppData\Local\Temp\HBL-20210508 INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\HBL-20210508 INVOICE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\HBL-20210508 INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\HBL-20210508 INVOICE.exe"
  2⤵
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\HBL-20210508 INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\HBL-20210508 INVOICE.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3404-134-0x0000000006290000-0x0000000006291000-memory.dmp

Download

memory/3404-133-0x00000000061F0000-0x00000000061F1000-memory.dmp

Download

memory/3404-132-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/3892-119-0x0000000005930000-0x0000000005931000-memory.dmp

Download

memory/3892-122-0x0000000005950000-0x0000000005E4E000-memory.dmp

Download

memory/3892-123-0x00000000066D0000-0x0000000006771000-memory.dmp

Download

memory/3892-124-0x0000000008C30000-0x0000000008C94000-memory.dmp

Download

memory/3892-121-0x0000000005B90000-0x0000000005B9E000-memory.dmp

Download

memory/3892-120-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Download

memory/3892-114-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/3892-118-0x00000000059F0000-0x00000000059F1000-memory.dmp

Download

memory/3892-117-0x0000000005E50000-0x0000000005E51000-memory.dmp

Download

memory/3892-116-0x0000000005830000-0x0000000005831000-memory.dmp

Download