agenttesla | 04538fa6efd1de9c1eb97acc72b3ce8f5625ab5a9e41c7eb7c9d753ccbb7881e

General

Target
Drawings-ESS316.exe
Size 882KB
Sample210601-2ep5pfasd2
SHA256 04538fa6efd1de9c1eb97acc72b3ce8f5625ab5a9e41c7eb7c9d753ccbb7881e
MD5 154d76c8e25f6677c320b9a8b871c7db
SHA1 250e0564bc343760d24d8c56c73349f261e6e5a2
SHA512 318da2bff428d0bbae32e0e3c8c14b64a3557933a913f57f0ab52c51f548e1c3766376293233e78eea52694f2664aff181483de3f55a0b845ebfb28e99ce9824
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
ireneoptik.ro
Port
587
Username
[email protected]
Password
BKAWTP=z?F_y

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1632-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1632-67-0x00000000004375AE-mapping.dmp	family_agenttesla
behavioral1/memory/1632-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ifeapp = "C:\\Users\\Admin\\AppData\\Roaming\\ifeapp\\ifeapp.exe"	Drawings-ESS316.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1292 set thread context of 1632	1292	Drawings-ESS316.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1632	Drawings-ESS316.exe
1632	Drawings-ESS316.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	Drawings-ESS316.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29
PID 1292 wrote to memory of 1632	1292	Drawings-ESS316.exe	29

C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe
"C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe
  "C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-60-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/1292-62-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/1292-63-0x0000000000370000-0x0000000000384000-memory.dmp

Download

memory/1292-64-0x00000000052B0000-0x0000000005349000-memory.dmp

Download

memory/1292-65-0x00000000042A0000-0x00000000042FD000-memory.dmp

Download

memory/1632-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1632-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1632-70-0x00000000048B0000-0x00000000048B1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads