agenttesla | fd7e560247eb18e1a27cfd3c46f10c06bcae05562df4b2862ec53caa76e80422

General

Target
823.exe
Size 857KB
Sample210713-ef5thwxfln
SHA256 fd7e560247eb18e1a27cfd3c46f10c06bcae05562df4b2862ec53caa76e80422
MD5 fc823514083f7b068ec30271361e88fb
SHA1 910000453b8aeca51e0887c9e0ed62270ca85bb4
SHA512 7961cb5fafb366769e730e926851b90d6789d997420d7bf983f07b51d4566b84bdf4144a852c313e95bf25d31cc544aec33672baf51ae48b67bd342380deb6cb
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

http://ahrend-cz.com/win/inc/f462c05ed33f1c.php

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1668-67-0x0000000000436DAE-mapping.dmp	family_agenttesla
behavioral1/memory/1668-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1668-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 1668	1828	823.exe	32

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1828	823.exe
1828	823.exe
1828	823.exe
1668	vbc.exe
1668	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	823.exe
Token: SeDebugPrivilege	1668	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1232	1828	823.exe	29
PID 1828 wrote to memory of 1232	1828	823.exe	29
PID 1828 wrote to memory of 1232	1828	823.exe	29
PID 1828 wrote to memory of 1232	1828	823.exe	29
PID 1828 wrote to memory of 1208	1828	823.exe	30
PID 1828 wrote to memory of 1208	1828	823.exe	30
PID 1828 wrote to memory of 1208	1828	823.exe	30
PID 1828 wrote to memory of 1208	1828	823.exe	30
PID 1828 wrote to memory of 1376	1828	823.exe	31
PID 1828 wrote to memory of 1376	1828	823.exe	31
PID 1828 wrote to memory of 1376	1828	823.exe	31
PID 1828 wrote to memory of 1376	1828	823.exe	31
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32
PID 1828 wrote to memory of 1668	1828	823.exe	32

C:\Users\Admin\AppData\Local\Temp\823.exe
"C:\Users\Admin\AppData\Local\Temp\823.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1668-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1668-70-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/1828-60-0x0000000000340000-0x0000000000341000-memory.dmp

Download

memory/1828-62-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/1828-63-0x0000000000420000-0x0000000000430000-memory.dmp

Download

memory/1828-64-0x0000000005D80000-0x0000000005E1F000-memory.dmp

Download

memory/1828-65-0x00000000007A0000-0x00000000007FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads