agenttesla | 8468cc08571c3290982083780878df02735e8dd243dc8fa606741e499303d97e

General

Target

QTY-3322.exe
Size

743KB
MD5

a3d83561dfbe5040966053844b20d68b
SHA1

02de62dee6785a08b2025fa21ecc8619bd6dcd35
SHA256

8468cc08571c3290982083780878df02735e8dd243dc8fa606741e499303d97e
SHA512

ca710982c00d4b98aee6a467dfb4f8f0264cf8e7139dbd3c6d4a1756bb5c70ff41cf9c7aeee45cf073ce4d3ef96280be36c9d3cbb34b7a3987f954c30b90971c

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.frtsolutinos.com
Port:
587
Username:
ops@frtsolutinos.com
Password:
N*+3lzCat9!x

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3452-115-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3452-116-0x000000000043736E-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

QTY-3322.exe

description pid process target process

PID 656 set thread context of 3452 656 QTY-3322.exe QTY-3322.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

QTY-3322.exe

pid process

3452 QTY-3322.exe
3452 QTY-3322.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

QTY-3322.exe

description pid process

Token: SeDebugPrivilege 3452 QTY-3322.exe

description	pid	process	target process
PID 656 set thread context of 3452	656	QTY-3322.exe	QTY-3322.exe

pid	process
3452	QTY-3322.exe
3452	QTY-3322.exe

description	pid	process
Token: SeDebugPrivilege	3452	QTY-3322.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

QTY-3322.exe

description	pid	process	target process
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe
PID 656 wrote to memory of 3452	656	QTY-3322.exe	QTY-3322.exe

C:\Users\Admin\AppData\Local\Temp\QTY-3322.exe
"C:\Users\Admin\AppData\Local\Temp\QTY-3322.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:656

C:\Users\Admin\AppData\Local\Temp\QTY-3322.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\QTY-3322.exe.log
MD5
ef140ef600b2463c9e7dbf064a104046

SHA1
c08fd1853877be95575ea2e860dd8cafef31f54c

SHA256
ad8ae97fdeb174b20f02c7ddf9466981856d77d51133599b5954f48f78a1b616

SHA512
bf16df0994080bdc832cb39a312e0095de57608256fcf0d04d589e0bdf3283f918fb0d6ec86ea28a4b1af6db12813c52a724028f02330ebc3a9d32a4fcda706c

Download Submit
memory/656-114-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/3452-115-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3452-116-0x000000000043736E-mapping.dmp

Download
memory/3452-118-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3452-119-0x00000000025B1000-0x00000000025B2000-memory.dmp

Filesize
4KB

Download
memory/3452-120-0x00000000025B2000-0x00000000025B3000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing