agenttesla | 7a97d4b8f134c45154aedab0230867952cc203fd283dca4700258edc86efb1e9

General

Target

3e2a1681fc8caef1b5d72e60a2d79691.exe
Size

466KB
MD5

c8bbdf9e3b59abed712d50939b1aba06
SHA1

d15a034d62161837581791b7fbf696259f0dceeb
SHA256

7a97d4b8f134c45154aedab0230867952cc203fd283dca4700258edc86efb1e9
SHA512

71b2480ea3a6b69d4a225d48b669beae1a864b3ce7521d4b34e5958d0ac9f8b511ba4acd8592fe3da5c91adaa02de8e807cd84979e535d307b3b7f71af74865c

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
PbQ)ubh9

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2008-116-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MSBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\YJsqpmZ = "C:\\Users\\Admin\\AppData\\Roaming\\YJsqpmZ\\YJsqpmZ.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

3e2a1681fc8caef1b5d72e60a2d79691.exe

description pid process target process

PID 996 set thread context of 2008 996 3e2a1681fc8caef1b5d72e60a2d79691.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

2008 MSBuild.exe
2008 MSBuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3e2a1681fc8caef1b5d72e60a2d79691.exe

pid process

996 3e2a1681fc8caef1b5d72e60a2d79691.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2008 MSBuild.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MSBuild.exe

pid process

2008 MSBuild.exe

description	pid	process	target process
PID 996 set thread context of 2008	996	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe

pid	process
2008	MSBuild.exe
2008	MSBuild.exe

pid	process
996	3e2a1681fc8caef1b5d72e60a2d79691.exe

description	pid	process
Token: SeDebugPrivilege	2008	MSBuild.exe

pid	process
2008	MSBuild.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3e2a1681fc8caef1b5d72e60a2d79691.exe

description	pid	process	target process
PID 996 wrote to memory of 2008	996	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe
PID 996 wrote to memory of 2008	996	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe
PID 996 wrote to memory of 2008	996	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe
PID 996 wrote to memory of 2008	996	3e2a1681fc8caef1b5d72e60a2d79691.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\3e2a1681fc8caef1b5d72e60a2d79691.exe
"C:\Users\Admin\AppData\Local\Temp\3e2a1681fc8caef1b5d72e60a2d79691.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\3e2a1681fc8caef1b5d72e60a2d79691.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2008

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/996-115-0x0000000002160000-0x0000000002162000-memory.dmp

Filesize
8KB

Download
memory/2008-114-0x000000000043749E-mapping.dmp

Download
memory/2008-116-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2008-118-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/2008-119-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/2008-120-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/2008-121-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

Filesize
4KB

Download
memory/2008-122-0x0000000005E90000-0x0000000005E91000-memory.dmp

Filesize
4KB

Download
memory/2008-123-0x0000000006690000-0x0000000006691000-memory.dmp

Filesize
4KB

Download
memory/2008-124-0x0000000002D31000-0x0000000002D32000-memory.dmp

Filesize
4KB

Download
memory/2008-125-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads