agenttesla | 7f046625d94dd2d644426aa367b9dd655094a6eeb17a71554a8aa485ea74d6be

General

Target

Required Purchase Order refe 73892000181901.exe
Size

636KB
MD5

551959b052a519efe0423cabf7d929aa
SHA1

49f73dedd4798c7932e16ecaefb5a4c05a44c012
SHA256

7f046625d94dd2d644426aa367b9dd655094a6eeb17a71554a8aa485ea74d6be
SHA512

e94ec24f4ee5804fa4309617aa7df61d50200b1a576c5e69f67e4c25a10d8db0b853b1730ff13e47dfd3cd125a2c85db1f55c09c04dd0bfb3b017892f2e67f75

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.basariotomotive.com/
Port:
21
Username:
loguru@basariotomotive.com
Password:
CrYBE.}*Igsm

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1192-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1192-126-0x0000000000436A9E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Required Purchase Order refe 73892000181901.exe

description	pid	process	target process
PID 1824 set thread context of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Required Purchase Order refe 73892000181901.exe

pid process

1192 Required Purchase Order refe 73892000181901.exe
1192 Required Purchase Order refe 73892000181901.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Required Purchase Order refe 73892000181901.exe

description pid process

Token: SeDebugPrivilege 1192 Required Purchase Order refe 73892000181901.exe

pid	process
1192	Required Purchase Order refe 73892000181901.exe
1192	Required Purchase Order refe 73892000181901.exe

description	pid	process
Token: SeDebugPrivilege	1192	Required Purchase Order refe 73892000181901.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Required Purchase Order refe 73892000181901.exe

description	pid	process	target process
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe
PID 1824 wrote to memory of 1192	1824	Required Purchase Order refe 73892000181901.exe	Required Purchase Order refe 73892000181901.exe

C:\Users\Admin\AppData\Local\Temp\Required Purchase Order refe 73892000181901.exe
"C:\Users\Admin\AppData\Local\Temp\Required Purchase Order refe 73892000181901.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\Required Purchase Order refe 73892000181901.exe
"C:\Users\Admin\AppData\Local\Temp\Required Purchase Order refe 73892000181901.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Required Purchase Order refe 73892000181901.exe.log
MD5
c3cc52ccca9ff2b6fa8d267fc350ca6b

SHA1
a68d4028333296d222e4afd75dea36fdc98d05f3

SHA256
3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

SHA512
b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

Download Submit
memory/1192-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1192-134-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/1192-133-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/1192-132-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1192-126-0x0000000000436A9E-mapping.dmp

Download
memory/1824-119-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/1824-123-0x0000000001500000-0x000000000157E000-memory.dmp

Filesize
504KB

Download
memory/1824-124-0x0000000008810000-0x0000000008850000-memory.dmp

Filesize
256KB

Download
memory/1824-122-0x00000000057B0000-0x00000000057B4000-memory.dmp

Filesize
16KB

Download
memory/1824-121-0x0000000005420000-0x000000000591E000-memory.dmp

Filesize
5.0MB

Download
memory/1824-120-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/1824-115-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1824-118-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/1824-117-0x0000000005920000-0x0000000005921000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads