agenttesla | ee0ce73cb38775e87e2e1e7391bd333a950027577b4bd3213422e396ba4ff3b1

General

Target

PO CPO_9785677-1 (ITN 095784).exe
Size

516KB
MD5

04ce2f0ca28c875383e53ba18fab1f16
SHA1

9b4b84d26cbf6c411ed8f4b862f3e28e4aee5a76
SHA256

ee0ce73cb38775e87e2e1e7391bd333a950027577b4bd3213422e396ba4ff3b1
SHA512

5e24ffc2f434e228cbb14e5199520b3ab6e1cf1a73a12bfaae389bba73f82bd4c1231e0d39c17447b456f6677315c0e9bfaa41e0052e6e9a67b6db6dc8586ad3

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vivaldi.net
Port:
587
Username:
frankmillloggins@vivaldi.net
Password:
Amalogs21345@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3292-127-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3292-128-0x00000000004374EE-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO CPO_9785677-1 (ITN 095784).exe

description pid process target process

PID 4016 set thread context of 3292 4016 PO CPO_9785677-1 (ITN 095784).exe PO CPO_9785677-1 (ITN 095784).exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

PO CPO_9785677-1 (ITN 095784).exePO CPO_9785677-1 (ITN 095784).exe

pid process

4016 PO CPO_9785677-1 (ITN 095784).exe
3292 PO CPO_9785677-1 (ITN 095784).exe
3292 PO CPO_9785677-1 (ITN 095784).exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO CPO_9785677-1 (ITN 095784).exePO CPO_9785677-1 (ITN 095784).exe

description pid process

Token: SeDebugPrivilege 4016 PO CPO_9785677-1 (ITN 095784).exe
Token: SeDebugPrivilege 3292 PO CPO_9785677-1 (ITN 095784).exe

description	pid	process	target process
PID 4016 set thread context of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe

pid	process
4016	PO CPO_9785677-1 (ITN 095784).exe
3292	PO CPO_9785677-1 (ITN 095784).exe
3292	PO CPO_9785677-1 (ITN 095784).exe

description	pid	process
Token: SeDebugPrivilege	4016	PO CPO_9785677-1 (ITN 095784).exe
Token: SeDebugPrivilege	3292	PO CPO_9785677-1 (ITN 095784).exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PO CPO_9785677-1 (ITN 095784).exe

description	pid	process	target process
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe
PID 4016 wrote to memory of 3292	4016	PO CPO_9785677-1 (ITN 095784).exe	PO CPO_9785677-1 (ITN 095784).exe

C:\Users\Admin\AppData\Local\Temp\PO CPO_9785677-1 (ITN 095784).exe
"C:\Users\Admin\AppData\Local\Temp\PO CPO_9785677-1 (ITN 095784).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\PO CPO_9785677-1 (ITN 095784).exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO CPO_9785677-1 (ITN 095784).exe.log
MD5
f63538e8f46716277d99afa59b82627f

SHA1
ac748880c856cc6269169df63ce0a3f5f2b3baba

SHA256
6074019b388daccdfd1267e5366c9d6fbf84abc98800313d44d66a6534a4cbed

SHA512
cb2e56c260d98371d86aa3c9eeda86da0ad47ebcad73050feb32cb6c3c4c446386caca95f948757c54d7921e16e8450aa960bda89626cdd153462a66ba3c2d5d

Download Submit
memory/3292-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3292-139-0x0000000002AE1000-0x0000000002AE2000-memory.dmp

Filesize
4KB

Download
memory/3292-136-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/3292-135-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/3292-134-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/3292-128-0x00000000004374EE-mapping.dmp

Download
memory/4016-119-0x0000000005560000-0x0000000005561000-memory.dmp

Filesize
4KB

Download
memory/4016-123-0x0000000005570000-0x0000000005572000-memory.dmp

Filesize
8KB

Download
memory/4016-124-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/4016-125-0x0000000005B20000-0x0000000005BA6000-memory.dmp

Filesize
536KB

Download
memory/4016-126-0x00000000054B0000-0x00000000054F3000-memory.dmp

Filesize
268KB

Download
memory/4016-122-0x0000000005563000-0x0000000005565000-memory.dmp

Filesize
8KB

Download
memory/4016-121-0x000000000EBA0000-0x000000000EBA1000-memory.dmp

Filesize
4KB

Download
memory/4016-120-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/4016-114-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/4016-118-0x000000000A8F0000-0x000000000A8F1000-memory.dmp

Filesize
4KB

Download
memory/4016-117-0x000000000ADF0000-0x000000000ADF1000-memory.dmp

Filesize
4KB

Download
memory/4016-116-0x0000000005350000-0x00000000053B3000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing