agenttesla | 12b4d5b703c8e2261c3fd995514959fa6cefb4cc2ed8ea409ddfc8353f2de741

General

Target
15348d2e7e60df90c2148faeb1907cfd.exe
Size 1.7MB
Sample210907-gr4zjsfbgn
SHA256 12b4d5b703c8e2261c3fd995514959fa6cefb4cc2ed8ea409ddfc8353f2de741
MD5 15348d2e7e60df90c2148faeb1907cfd
SHA1 ff9ff84b6548285f3390cbe7e74be41e9d5003e9
SHA512 e5bc68ac19404f7afef6f8248d513d87ab65966daea43a704f1615f4228c2547be9c8460bb5510a46ace70794dfbac69d8e94dd9a43a35fae8a7b2774a6a04a3
MD5 SHA1 SHA512

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.dm-teh.com
Port
587
Username
[email protected]
Password
Vm@(O;CO.vEQ

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1072-68-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/1072-70-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/1072-73-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

pid	Process
1072	InstallUtil.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	15348d2e7e60df90c2148faeb1907cfd.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1696-62-0x00000000007F0000-0x0000000000811000-memory.dmp	agile_net

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	15348d2e7e60df90c2148faeb1907cfd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	15348d2e7e60df90c2148faeb1907cfd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	15348d2e7e60df90c2148faeb1907cfd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1696	15348d2e7e60df90c2148faeb1907cfd.exe
1696	15348d2e7e60df90c2148faeb1907cfd.exe
1072	InstallUtil.exe
1072	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	15348d2e7e60df90c2148faeb1907cfd.exe
Token: SeDebugPrivilege	1072	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29
PID 1696 wrote to memory of 1072	1696	15348d2e7e60df90c2148faeb1907cfd.exe	29

C:\Users\Admin\AppData\Local\Temp\15348d2e7e60df90c2148faeb1907cfd.exe
"C:\Users\Admin\AppData\Local\Temp\15348d2e7e60df90c2148faeb1907cfd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-70-0x0000000000090000-0x00000000000CC000-memory.dmp

Download

memory/1072-73-0x0000000000090000-0x00000000000CC000-memory.dmp

Download

memory/1072-75-0x0000000000090000-0x0000000000092000-memory.dmp

Download

memory/1072-77-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/1072-78-0x0000000004BC1000-0x0000000004BC2000-memory.dmp

Download

memory/1696-63-0x0000000004E01000-0x0000000004E02000-memory.dmp

Download

memory/1696-64-0x0000000000860000-0x000000000086B000-memory.dmp

Download

memory/1696-65-0x00000000022C0000-0x00000000022C1000-memory.dmp

Download

memory/1696-59-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/1696-62-0x00000000007F0000-0x0000000000811000-memory.dmp

Download

memory/1696-61-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads