agenttesla | 5562cf5618942d43bb59a893bb14f3bb1b45e98550a1bc82a4a75a4b5e504e23

General

Target

Inv_7623980.exe
Size

930KB
MD5

af3a59ad59b90cdbb755d2226f07d2f2
SHA1

da66f2c7723a91e3a2db3e9d30fce20a3a5443a1
SHA256

0f19539c1aca12bf11bb1084ea7745240b7b7690a80140c757de6ed382eb58c1
SHA512

27143a3d2766b4908cedab8dab6d2522d09e5238d93527b5ed34320312558ce566032afd8ffdd1de461e893cef68dc80298f7a80a34a59e7d80c75b649191fa6

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.shivsundaram.com
Port:
587
Username:
[email protected]
Password:
hemant@10023

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3760-124-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3760-125-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral2/memory/3760-131-0x0000000005600000-0x0000000005AFE000-memory.dmp	family_agenttesla
behavioral2/memory/3760-136-0x0000000005600000-0x0000000005AFE000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

Inv_7623980.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts Inv_7623980.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Inv_7623980.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Inv_7623980.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe"	Inv_7623980.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Inv_7623980.exe

description pid process target process

PID 632 set thread context of 3760 632 Inv_7623980.exe Inv_7623980.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Inv_7623980.exe

pid process

3760 Inv_7623980.exe
3760 Inv_7623980.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Inv_7623980.exe

description pid process

Token: SeDebugPrivilege 3760 Inv_7623980.exe

description	pid	process	target process
PID 632 set thread context of 3760	632	Inv_7623980.exe	Inv_7623980.exe

pid	process
3760	Inv_7623980.exe
3760	Inv_7623980.exe

description	pid	process
Token: SeDebugPrivilege	3760	Inv_7623980.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Inv_7623980.exe

description	pid	process	target process
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3760	632	Inv_7623980.exe	Inv_7623980.exe

C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
  "C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Inv_7623980.exe.log

MD5
cd6a7ef88aaff4e17c603a213131c2c7

SHA1
603f96001fc4798064b35e699a46da82849c1422

SHA256
8aac4ffc0fc50f238b81ebd0514d2fdc8b577b09c544e233d8ec6158b12d1d21

SHA512
08bbd52c32b5ef9a58c2d0857b3f56fccab9502bd38133f01e1579c48b267f29486941547477d1dbfbbb9155ddc9ec703a5fc5de5ad60a31f60103f3fec5efaf

Download Submit
memory/632-123-0x0000000005490000-0x000000000549F000-memory.dmp

Filesize
60KB

Download
memory/632-116-0x0000000002D80000-0x0000000002D81000-memory.dmp

Filesize
4KB

Download
memory/632-118-0x0000000005270000-0x00000000052D8000-memory.dmp

Filesize
416KB

Download
memory/632-119-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/632-121-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/632-117-0x00000000014B0000-0x00000000014B1000-memory.dmp

Filesize
4KB

Download
memory/632-122-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/632-120-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/3760-125-0x000000000043760E-mapping.dmp

Download
memory/3760-124-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3760-131-0x0000000005600000-0x0000000005AFE000-memory.dmp

Filesize
5.0MB

Download
memory/3760-132-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/3760-133-0x0000000006360000-0x0000000006361000-memory.dmp

Filesize
4KB

Download
memory/3760-135-0x0000000006340000-0x0000000006341000-memory.dmp

Filesize
4KB

Download
memory/3760-136-0x0000000005600000-0x0000000005AFE000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads