agenttesla | f7d8bb7108bdfc37cb94c9c04d73ba60d693f03411332ae31a7da4ad82e9a7ff

Analysis

max time kernel
134s
max time network
112s
platform
windows10_x64
resource
win10v20210410
submitted
02/08/2021, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-K-128 IAN 340854.exe
Size 852KB
Sample210802-sb1x2fd75s
SHA256 f7d8bb7108bdfc37cb94c9c04d73ba60d693f03411332ae31a7da4ad82e9a7ff
MD5 e7b5dd9322e5e8700f84a7e25ff8533a
SHA1 25a539bfbed3f8cd7a8e2b579967ffa3f953ec38
SHA512 83c875105ab38470ae5a4f85d88177415a1bb6c38439e77fe440b7a159801727b34c0b41cf01eb10b512ae10e87a26010c7475c2a73f7f82ac29a96bdf5eaa06
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.odessabd.com
Port
587
Username
[email protected]
Password
abc321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1016-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1016-126-0x000000000043760E-mapping.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/3908-122-0x0000000004F70000-0x0000000004F7B000-memory.dmp	CustAttr

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 1016	3908	PO-K-128 IAN 340854.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	RegSvcs.exe
1016	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	PO-K-128 IAN 340854.exe
Token: SeDebugPrivilege	1016	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79
PID 3908 wrote to memory of 1016	3908	PO-K-128 IAN 340854.exe	79

C:\Users\Admin\AppData\Local\Temp\PO-K-128 IAN 340854.exe
"C:\Users\Admin\AppData\Local\Temp\PO-K-128 IAN 340854.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1016-136-0x0000000005421000-0x0000000005422000-memory.dmp

Download

memory/1016-133-0x00000000061E0000-0x00000000061E1000-memory.dmp

Download

memory/1016-132-0x0000000006040000-0x0000000006041000-memory.dmp

Download

memory/1016-131-0x0000000005420000-0x0000000005421000-memory.dmp

Download

memory/3908-119-0x0000000004B10000-0x0000000004B11000-memory.dmp

Download

memory/3908-122-0x0000000004F70000-0x0000000004F7B000-memory.dmp

Download

memory/3908-123-0x0000000008300000-0x000000000837B000-memory.dmp

Download

memory/3908-124-0x0000000008380000-0x00000000083BD000-memory.dmp

Download

memory/3908-121-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

memory/3908-120-0x0000000004AF0000-0x0000000004FEE000-memory.dmp

Download

memory/3908-114-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/3908-118-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/3908-117-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Download

memory/3908-116-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download