agenttesla | 515aeac4841b51f4ef59ace6b939e49eb902b00c4bd2f7a0c433ac260448b93f

General

Target
2c265a8715c2c8f85d0ffea12226b8dd.exe
Size 1.8MB
Sample210906-pt342aecan
SHA256 515aeac4841b51f4ef59ace6b939e49eb902b00c4bd2f7a0c433ac260448b93f
MD5 2c265a8715c2c8f85d0ffea12226b8dd
SHA1 69f37f4d9bc5399ac093f50c1b4e47cee05441b3
SHA512 af94f74235ead3d7c8eee1b13e2de0994b8c833eb721087e8a033e4e41b429983c461ae0ff7b0914f3129be3035a862eda7bce569d8aa4319233d8b53bfbdc8b
MD5 SHA1 SHA512

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.dm-teh.com
Port
587
Username
[email protected]
Password
Vm@(O;CO.vEQ

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1836-62-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/1836-64-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/1836-67-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

pid	Process
1836	InstallUtil.exe

Loads dropped DLL 1 IoCs

pid	Process
1136	2c265a8715c2c8f85d0ffea12226b8dd.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1136-56-0x0000000000670000-0x0000000000691000-memory.dmp	agile_net

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1136 set thread context of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	2c265a8715c2c8f85d0ffea12226b8dd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	2c265a8715c2c8f85d0ffea12226b8dd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	2c265a8715c2c8f85d0ffea12226b8dd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1136	2c265a8715c2c8f85d0ffea12226b8dd.exe
1136	2c265a8715c2c8f85d0ffea12226b8dd.exe
1836	InstallUtil.exe
1836	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe
Token: SeDebugPrivilege	1836	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30
PID 1136 wrote to memory of 1836	1136	2c265a8715c2c8f85d0ffea12226b8dd.exe	30

C:\Users\Admin\AppData\Local\Temp\2c265a8715c2c8f85d0ffea12226b8dd.exe
"C:\Users\Admin\AppData\Local\Temp\2c265a8715c2c8f85d0ffea12226b8dd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-57-0x0000000004F01000-0x0000000004F02000-memory.dmp

Download

memory/1136-58-0x0000000000900000-0x000000000090B000-memory.dmp

Download

memory/1136-59-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/1136-53-0x00000000001A0000-0x00000000001A1000-memory.dmp

Download

memory/1136-56-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/1136-55-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/1836-64-0x0000000000090000-0x00000000000CC000-memory.dmp

Download

memory/1836-67-0x0000000000090000-0x00000000000CC000-memory.dmp

Download

memory/1836-69-0x0000000000090000-0x0000000000092000-memory.dmp

Download

memory/1836-71-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/1836-72-0x0000000000961000-0x0000000000962000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads