agenttesla | 04538fa6efd1de9c1eb97acc72b3ce8f5625ab5a9e41c7eb7c9d753ccbb7881e

Analysis

max time kernel
146s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
01/06/2021, 08:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Drawings-ESS316.exe
Size 882KB
Sample210601-2ep5pfasd2
SHA256 04538fa6efd1de9c1eb97acc72b3ce8f5625ab5a9e41c7eb7c9d753ccbb7881e
MD5 154d76c8e25f6677c320b9a8b871c7db
SHA1 250e0564bc343760d24d8c56c73349f261e6e5a2
SHA512 318da2bff428d0bbae32e0e3c8c14b64a3557933a913f57f0ab52c51f548e1c3766376293233e78eea52694f2664aff181483de3f55a0b845ebfb28e99ce9824
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
ireneoptik.ro
Port
587
Username
[email protected]
Password
BKAWTP=z?F_y

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2628-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2628-126-0x00000000004375AE-mapping.dmp	family_agenttesla
behavioral2/memory/2628-132-0x0000000004DE0000-0x00000000052DE000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ifeapp = "C:\\Users\\Admin\\AppData\\Roaming\\ifeapp\\ifeapp.exe"	Drawings-ESS316.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3904 set thread context of 2628	3904	Drawings-ESS316.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3904	Drawings-ESS316.exe
3904	Drawings-ESS316.exe
2628	Drawings-ESS316.exe
2628	Drawings-ESS316.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	Drawings-ESS316.exe
Token: SeDebugPrivilege	2628	Drawings-ESS316.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 1916	3904	Drawings-ESS316.exe	79
PID 3904 wrote to memory of 1916	3904	Drawings-ESS316.exe	79
PID 3904 wrote to memory of 1916	3904	Drawings-ESS316.exe	79
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80
PID 3904 wrote to memory of 2628	3904	Drawings-ESS316.exe	80

C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe
"C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe
  "C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe"
  2⤵
  PID:1916
- C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe
  "C:\Users\Admin\AppData\Local\Temp\Drawings-ESS316.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2628-134-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Download

memory/2628-133-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download

memory/2628-132-0x0000000004DE0000-0x00000000052DE000-memory.dmp

Download

memory/3904-119-0x0000000005840000-0x0000000005841000-memory.dmp

Download

memory/3904-122-0x0000000005C90000-0x0000000005CA4000-memory.dmp

Download

memory/3904-123-0x0000000007DD0000-0x0000000007E69000-memory.dmp

Download

memory/3904-124-0x000000000A470000-0x000000000A4CD000-memory.dmp

Download

memory/3904-121-0x00000000057F0000-0x0000000005CEE000-memory.dmp

Download

memory/3904-120-0x0000000005A50000-0x0000000005A51000-memory.dmp

Download

memory/3904-114-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/3904-118-0x0000000005890000-0x0000000005891000-memory.dmp

Download

memory/3904-117-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Download

memory/3904-116-0x0000000005750000-0x0000000005751000-memory.dmp

Download