agenttesla | f7d8bb7108bdfc37cb94c9c04d73ba60d693f03411332ae31a7da4ad82e9a7ff

General

Target
PO-K-128 IAN 340854.exe
Size 852KB
Sample210802-sb1x2fd75s
SHA256 f7d8bb7108bdfc37cb94c9c04d73ba60d693f03411332ae31a7da4ad82e9a7ff
MD5 e7b5dd9322e5e8700f84a7e25ff8533a
SHA1 25a539bfbed3f8cd7a8e2b579967ffa3f953ec38
SHA512 83c875105ab38470ae5a4f85d88177415a1bb6c38439e77fe440b7a159801727b34c0b41cf01eb10b512ae10e87a26010c7475c2a73f7f82ac29a96bdf5eaa06
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.odessabd.com
Port
587
Username
[email protected]
Password
abc321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1108-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1108-67-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/1108-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/1948-63-0x0000000000510000-0x000000000051B000-memory.dmp	CustAttr

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 1108	1948	PO-K-128 IAN 340854.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	RegSvcs.exe
1108	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29
PID 1948 wrote to memory of 1108	1948	PO-K-128 IAN 340854.exe	29

C:\Users\Admin\AppData\Local\Temp\PO-K-128 IAN 340854.exe
"C:\Users\Admin\AppData\Local\Temp\PO-K-128 IAN 340854.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1108-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1108-70-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/1108-71-0x0000000004A41000-0x0000000004A42000-memory.dmp

Download

memory/1948-60-0x0000000001350000-0x0000000001351000-memory.dmp

Download

memory/1948-62-0x0000000001300000-0x0000000001301000-memory.dmp

Download

memory/1948-63-0x0000000000510000-0x000000000051B000-memory.dmp

Download

memory/1948-64-0x0000000005F10000-0x0000000005F8B000-memory.dmp

Download

memory/1948-65-0x00000000009F0000-0x0000000000A2D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads