agenttesla | ffaa83970c7e63b1170180e13182f12de2db59777deb86d40c268c02cad2fe9d

General

Target
PO_LRTC17086.exe
Size 745KB
Sample210708-34srt4yndx
SHA256 15189732a875a6464e53bee90a29e181cd6bf8420b8b7a86f0cafd36e9e86a44
MD5 c16b00d793de82af17d09f4719610739
SHA1 02e5f0b35ad4caec4ebb6ae25b4ae5e155a78af7
SHA512 1681df7b0423b584a6c5be3308ae3d8bac74809e1c8735c141bb6da973e93383daac741b0c8a7f94d10d9e691b52170ba4fba640dda7a8f7cb7ec3f6c4ca2c4a
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.kabalanhome.com
Port
587
Username
[email protected]
Password
lb9938

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1476-67-0x000000000043784E-mapping.dmp	family_agenttesla
behavioral1/memory/1476-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1476-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 1476	2020	PO_LRTC17086.exe	33

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2020	PO_LRTC17086.exe
2020	PO_LRTC17086.exe
2020	PO_LRTC17086.exe
2020	PO_LRTC17086.exe
1476	PO_LRTC17086.exe
1476	PO_LRTC17086.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	PO_LRTC17086.exe
Token: SeDebugPrivilege	1476	PO_LRTC17086.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1476	PO_LRTC17086.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 268	2020	PO_LRTC17086.exe	29
PID 2020 wrote to memory of 268	2020	PO_LRTC17086.exe	29
PID 2020 wrote to memory of 268	2020	PO_LRTC17086.exe	29
PID 2020 wrote to memory of 268	2020	PO_LRTC17086.exe	29
PID 2020 wrote to memory of 792	2020	PO_LRTC17086.exe	30
PID 2020 wrote to memory of 792	2020	PO_LRTC17086.exe	30
PID 2020 wrote to memory of 792	2020	PO_LRTC17086.exe	30
PID 2020 wrote to memory of 792	2020	PO_LRTC17086.exe	30
PID 2020 wrote to memory of 1072	2020	PO_LRTC17086.exe	31
PID 2020 wrote to memory of 1072	2020	PO_LRTC17086.exe	31
PID 2020 wrote to memory of 1072	2020	PO_LRTC17086.exe	31
PID 2020 wrote to memory of 1072	2020	PO_LRTC17086.exe	31
PID 2020 wrote to memory of 1028	2020	PO_LRTC17086.exe	32
PID 2020 wrote to memory of 1028	2020	PO_LRTC17086.exe	32
PID 2020 wrote to memory of 1028	2020	PO_LRTC17086.exe	32
PID 2020 wrote to memory of 1028	2020	PO_LRTC17086.exe	32
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33
PID 2020 wrote to memory of 1476	2020	PO_LRTC17086.exe	33

C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe
"C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe"
  2⤵
  PID:792
- C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe"
  2⤵
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe"
  2⤵
  PID:1028
- C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_LRTC17086.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1476-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1476-70-0x0000000004820000-0x0000000004821000-memory.dmp

Download

memory/1476-71-0x0000000004821000-0x0000000004822000-memory.dmp

Download

memory/2020-60-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2020-62-0x00000000050F0000-0x00000000050F1000-memory.dmp

Download

memory/2020-63-0x0000000000220000-0x000000000022F000-memory.dmp

Download

memory/2020-64-0x0000000007F90000-0x000000000800D000-memory.dmp

Download

memory/2020-65-0x0000000005E10000-0x0000000005E5B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads