agenttesla | 6786461e40eb0f01aae080ffd69a58eee8d8997e7c4d6e20abed3f24119f5633

General

Target

NUOVO_ORDINE.exe
Size

1006KB
MD5

2aafcce94fdbdab28bc6ea753696b34d
SHA1

21f6503ca90d2706a285481df4022eabfa1a8f5b
SHA256

6786461e40eb0f01aae080ffd69a58eee8d8997e7c4d6e20abed3f24119f5633
SHA512

1bf83b7590ca44f093d9d569c7431056162829ef34b3373c29b38d47cfd45cd4bd973c59fcf218608d8ab2e17df0ee6b96b8e6f3e26972458983bfc2ca051c70

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.kenner-tw.com
Port:
587
Username:
[email protected]
Password:
IElbAu@Kj5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1368-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1368-126-0x00000000004375BE-mapping.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MSBuild.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\qXLPL = "C:\\Users\\Admin\\AppData\\Roaming\\qXLPL\\qXLPL.exe"	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

NUOVO_ORDINE.exe

description pid process target process

PID 3912 set thread context of 1368 3912 NUOVO_ORDINE.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

1368 MSBuild.exe
1368 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

NUOVO_ORDINE.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 3912 NUOVO_ORDINE.exe
Token: SeDebugPrivilege 1368 MSBuild.exe

description	pid	process	target process
PID 3912 set thread context of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe

pid	process
1368	MSBuild.exe
1368	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3912	NUOVO_ORDINE.exe
Token: SeDebugPrivilege	1368	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

NUOVO_ORDINE.exe

description	pid	process	target process
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe
PID 3912 wrote to memory of 1368	3912	NUOVO_ORDINE.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\NUOVO_ORDINE.exe
"C:\Users\Admin\AppData\Local\Temp\NUOVO_ORDINE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1368-133-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download
memory/1368-132-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/1368-131-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/1368-126-0x00000000004375BE-mapping.dmp

Download
memory/3912-121-0x0000000004F30000-0x000000000542E000-memory.dmp

Filesize
5.0MB

Download
memory/3912-114-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3912-122-0x0000000005240000-0x000000000525B000-memory.dmp

Filesize
108KB

Download
memory/3912-123-0x0000000008590000-0x0000000008611000-memory.dmp

Filesize
516KB

Download
memory/3912-124-0x0000000008620000-0x000000000865C000-memory.dmp

Filesize
240KB

Download
memory/3912-120-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/3912-119-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3912-118-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/3912-117-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/3912-116-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads