agenttesla | 2442c3ecd04264f108429a954275ee27986e00b79cbce6d07843dfefdf4d24af

General

Target

Inquiry - Specifications 002021.exe
Size

860KB
MD5

768a1127c119149f96a29c0d0c0b56ec
SHA1

afe86ab8d4a8b5b092e95f1cb2ae563f5ea5867d
SHA256

2442c3ecd04264f108429a954275ee27986e00b79cbce6d07843dfefdf4d24af
SHA512

9288f45ef09172b28a4fa542b2ead2a2026b910eb229859125da6bfb735e0178e7e8dcd7c4eddc590646e409ccb6e180b24813f059e7f5f161983a3b7749c672

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vern-group.com
Port:
587
Username:
annett.jalowi@vern-group.com
Password:
HUSTLE2021

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1728-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1728-66-0x000000000043785E-mapping.dmp	family_agenttesla
behavioral1/memory/1728-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Inquiry - Specifications 002021.exe

description pid process target process

PID 564 set thread context of 1728 564 Inquiry - Specifications 002021.exe Inquiry - Specifications 002021.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Inquiry - Specifications 002021.exe

pid process

1728 Inquiry - Specifications 002021.exe
1728 Inquiry - Specifications 002021.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

Inquiry - Specifications 002021.exe

pid process

1728 Inquiry - Specifications 002021.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Inquiry - Specifications 002021.exe

description pid process

Token: SeDebugPrivilege 1728 Inquiry - Specifications 002021.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Inquiry - Specifications 002021.exe

pid process

1728 Inquiry - Specifications 002021.exe

description	pid	process	target process
PID 564 set thread context of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe

pid	process
1728	Inquiry - Specifications 002021.exe
1728	Inquiry - Specifications 002021.exe

pid	process
1728	Inquiry - Specifications 002021.exe

description	pid	process
Token: SeDebugPrivilege	1728	Inquiry - Specifications 002021.exe

pid	process
1728	Inquiry - Specifications 002021.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Inquiry - Specifications 002021.exe

description	pid	process	target process
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe
PID 564 wrote to memory of 1728	564	Inquiry - Specifications 002021.exe	Inquiry - Specifications 002021.exe

C:\Users\Admin\AppData\Local\Temp\Inquiry - Specifications 002021.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry - Specifications 002021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:564

C:\Users\Admin\AppData\Local\Temp\Inquiry - Specifications 002021.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry - Specifications 002021.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1728

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-59-0x00000000012A0000-0x00000000012A1000-memory.dmp

Filesize
4KB

Download
memory/564-61-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/564-62-0x0000000000350000-0x0000000000357000-memory.dmp

Filesize
28KB

Download
memory/564-63-0x0000000005010000-0x0000000005078000-memory.dmp

Filesize
416KB

Download
memory/564-64-0x00000000008E0000-0x000000000091D000-memory.dmp

Filesize
244KB

Download
memory/1728-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1728-66-0x000000000043785E-mapping.dmp

Download
memory/1728-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1728-69-0x0000000004910000-0x0000000004911000-memory.dmp

Filesize
4KB

Download
memory/1728-70-0x0000000004911000-0x0000000004912000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing