agenttesla | 6786461e40eb0f01aae080ffd69a58eee8d8997e7c4d6e20abed3f24119f5633

General

Target

NUOVO_ORDINE.exe
Size

1006KB
MD5

2aafcce94fdbdab28bc6ea753696b34d
SHA1

21f6503ca90d2706a285481df4022eabfa1a8f5b
SHA256

6786461e40eb0f01aae080ffd69a58eee8d8997e7c4d6e20abed3f24119f5633
SHA512

1bf83b7590ca44f093d9d569c7431056162829ef34b3373c29b38d47cfd45cd4bd973c59fcf218608d8ab2e17df0ee6b96b8e6f3e26972458983bfc2ca051c70

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.kenner-tw.com
Port:
587
Username:
[email protected]
Password:
IElbAu@Kj5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1488-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1488-66-0x00000000004375BE-mapping.dmp	family_agenttesla
behavioral1/memory/1488-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MSBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\qXLPL = "C:\\Users\\Admin\\AppData\\Roaming\\qXLPL\\qXLPL.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

NUOVO_ORDINE.exe

description pid process target process

PID 1864 set thread context of 1488 1864 NUOVO_ORDINE.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

NUOVO_ORDINE.exeMSBuild.exe

pid process

1864 NUOVO_ORDINE.exe
1864 NUOVO_ORDINE.exe
1864 NUOVO_ORDINE.exe
1864 NUOVO_ORDINE.exe
1864 NUOVO_ORDINE.exe
1488 MSBuild.exe
1488 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

NUOVO_ORDINE.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 1864 NUOVO_ORDINE.exe
Token: SeDebugPrivilege 1488 MSBuild.exe

description	pid	process	target process
PID 1864 set thread context of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe

pid	process
1864	NUOVO_ORDINE.exe
1864	NUOVO_ORDINE.exe
1864	NUOVO_ORDINE.exe
1864	NUOVO_ORDINE.exe
1864	NUOVO_ORDINE.exe
1488	MSBuild.exe
1488	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	1864	NUOVO_ORDINE.exe
Token: SeDebugPrivilege	1488	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

NUOVO_ORDINE.exe

description	pid	process	target process
PID 1864 wrote to memory of 436	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 436	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 436	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 436	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 380	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 380	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 380	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 380	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe
PID 1864 wrote to memory of 1488	1864	NUOVO_ORDINE.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\NUOVO_ORDINE.exe
"C:\Users\Admin\AppData\Local\Temp\NUOVO_ORDINE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1488-66-0x00000000004375BE-mapping.dmp

Download
memory/1488-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1488-69-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/1864-59-0x0000000000F40000-0x0000000000F41000-memory.dmp

Filesize
4KB

Download
memory/1864-61-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/1864-62-0x0000000000350000-0x000000000036B000-memory.dmp

Filesize
108KB

Download
memory/1864-63-0x0000000007F00000-0x0000000007F81000-memory.dmp

Filesize
516KB

Download
memory/1864-64-0x0000000000A20000-0x0000000000A5C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads