agenttesla | ebc999fd981f9cea0d7d285e952ba232d95869b9ddfc33030b98deb0f782a07f

General

Target

70654 SSEBACT.exe
Size

641KB
MD5

4e09874338d28600e8b84184f143bfe8
SHA1

488979983bfa154fbb27563454e67903c37e16c3
SHA256

ca87f3892de6e488e61c352cafc36fc06d0d8b6eb9fc4d5429ff92038c4b134f
SHA512

d58e1582e77fff96197fd7a5d463249ab619a9455a6d1425fdc913f42ac3b60a7fd46ed0f11cac00aee8a97055d86842f7fed1f85cb5a11c59d66a702d7212b2

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
uscentral50.myserverhosts.com
Port:
587
Username:
sales@radheatwaters.com
Password:
waters@789

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4680-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/4680-126-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral2/memory/4680-131-0x0000000004CF0000-0x00000000051EE000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\NXLun = "C:\\Users\\Admin\\AppData\\Roaming\\NXLun\\NXLun.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

70654 SSEBACT.exe

description pid process target process

PID 4564 set thread context of 4680 4564 70654 SSEBACT.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

70654 SSEBACT.exeRegSvcs.exe

pid process

4564 70654 SSEBACT.exe
4564 70654 SSEBACT.exe
4564 70654 SSEBACT.exe
4564 70654 SSEBACT.exe
4680 RegSvcs.exe
4680 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

70654 SSEBACT.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 4564 70654 SSEBACT.exe
Token: SeDebugPrivilege 4680 RegSvcs.exe

description	pid	process	target process
PID 4564 set thread context of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe

pid	process
4564	70654 SSEBACT.exe
4564	70654 SSEBACT.exe
4564	70654 SSEBACT.exe
4564	70654 SSEBACT.exe
4680	RegSvcs.exe
4680	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4564	70654 SSEBACT.exe
Token: SeDebugPrivilege	4680	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

70654 SSEBACT.exe

description	pid	process	target process
PID 4564 wrote to memory of 4672	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4672	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4672	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe
PID 4564 wrote to memory of 4680	4564	70654 SSEBACT.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\70654 SSEBACT.exe
"C:\Users\Admin\AppData\Local\Temp\70654 SSEBACT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:4672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4564-115-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/4564-117-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/4564-118-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/4564-119-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/4564-120-0x0000000005390000-0x000000000588E000-memory.dmp

Filesize
5.0MB

Download
memory/4564-121-0x0000000008D00000-0x0000000008D07000-memory.dmp

Filesize
28KB

Download
memory/4564-122-0x0000000008DC0000-0x0000000008DC1000-memory.dmp

Filesize
4KB

Download
memory/4564-123-0x0000000008D50000-0x0000000008DB3000-memory.dmp

Filesize
396KB

Download
memory/4564-124-0x000000000B5C0000-0x000000000B5FC000-memory.dmp

Filesize
240KB

Download
memory/4680-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4680-126-0x000000000043760E-mapping.dmp

Download
memory/4680-131-0x0000000004CF0000-0x00000000051EE000-memory.dmp

Filesize
5.0MB

Download
memory/4680-132-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/4680-133-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads