agenttesla | 77a2859ef248804ae58920aa53cbdae4dcf7296c0ef7dcd2397014bd5b9bed3f

Analysis

max time kernel
112s
max time network
153s
platform
windows10_x64
resource
win10-en-20211208
submitted
14/01/2022, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DBS_Bank_ Payment Copy_Pdf.exe
Size 38KB
Sample220114-m8j9csgaep
SHA256 77a2859ef248804ae58920aa53cbdae4dcf7296c0ef7dcd2397014bd5b9bed3f
MD5 286d4c71e16196ee05d2fc1350141e3e
SHA1 0d66a22ae06ff01f76d752da1593a785dc8d2363
SHA512 1a276a2b2e53a0fad48563211288eafc9b93255b11f75d5306d772fea9c74bd23fe875fc5d1090fcfad129ca90e01a54202806f68587a9055872fa11a1ab9ef8
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.meyaargroup.com
Port
587
Username
[email protected]
Password
Meyaar@123$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral2/memory/2984-139-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2984-140-0x0000000000436D0E-mapping.dmp	family_agenttesla
behavioral2/memory/2984-142-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2984-143-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 712 set thread context of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 8 IoCs

evasion

pid	Process
988	timeout.exe
2376	timeout.exe
3708	timeout.exe
3208	timeout.exe
404	timeout.exe
1528	timeout.exe
1736	timeout.exe
1276	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
712	DBS_Bank_ Payment Copy_Pdf.exe
712	DBS_Bank_ Payment Copy_Pdf.exe
2984	DBS_Bank_ Payment Copy_Pdf.exe
2984	DBS_Bank_ Payment Copy_Pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	712	DBS_Bank_ Payment Copy_Pdf.exe
Token: SeDebugPrivilege	2984	DBS_Bank_ Payment Copy_Pdf.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 1420	712	DBS_Bank_ Payment Copy_Pdf.exe	70
PID 712 wrote to memory of 1420	712	DBS_Bank_ Payment Copy_Pdf.exe	70
PID 712 wrote to memory of 1420	712	DBS_Bank_ Payment Copy_Pdf.exe	70
PID 1420 wrote to memory of 3708	1420	cmd.exe	72
PID 1420 wrote to memory of 3708	1420	cmd.exe	72
PID 1420 wrote to memory of 3708	1420	cmd.exe	72
PID 712 wrote to memory of 836	712	DBS_Bank_ Payment Copy_Pdf.exe	73
PID 712 wrote to memory of 836	712	DBS_Bank_ Payment Copy_Pdf.exe	73
PID 712 wrote to memory of 836	712	DBS_Bank_ Payment Copy_Pdf.exe	73
PID 836 wrote to memory of 3208	836	cmd.exe	75
PID 836 wrote to memory of 3208	836	cmd.exe	75
PID 836 wrote to memory of 3208	836	cmd.exe	75
PID 712 wrote to memory of 3280	712	DBS_Bank_ Payment Copy_Pdf.exe	76
PID 712 wrote to memory of 3280	712	DBS_Bank_ Payment Copy_Pdf.exe	76
PID 712 wrote to memory of 3280	712	DBS_Bank_ Payment Copy_Pdf.exe	76
PID 3280 wrote to memory of 404	3280	cmd.exe	78
PID 3280 wrote to memory of 404	3280	cmd.exe	78
PID 3280 wrote to memory of 404	3280	cmd.exe	78
PID 712 wrote to memory of 3200	712	DBS_Bank_ Payment Copy_Pdf.exe	79
PID 712 wrote to memory of 3200	712	DBS_Bank_ Payment Copy_Pdf.exe	79
PID 712 wrote to memory of 3200	712	DBS_Bank_ Payment Copy_Pdf.exe	79
PID 3200 wrote to memory of 1528	3200	cmd.exe	81
PID 3200 wrote to memory of 1528	3200	cmd.exe	81
PID 3200 wrote to memory of 1528	3200	cmd.exe	81
PID 712 wrote to memory of 2924	712	DBS_Bank_ Payment Copy_Pdf.exe	82
PID 712 wrote to memory of 2924	712	DBS_Bank_ Payment Copy_Pdf.exe	82
PID 712 wrote to memory of 2924	712	DBS_Bank_ Payment Copy_Pdf.exe	82
PID 2924 wrote to memory of 1736	2924	cmd.exe	84
PID 2924 wrote to memory of 1736	2924	cmd.exe	84
PID 2924 wrote to memory of 1736	2924	cmd.exe	84
PID 712 wrote to memory of 1068	712	DBS_Bank_ Payment Copy_Pdf.exe	85
PID 712 wrote to memory of 1068	712	DBS_Bank_ Payment Copy_Pdf.exe	85
PID 712 wrote to memory of 1068	712	DBS_Bank_ Payment Copy_Pdf.exe	85
PID 1068 wrote to memory of 1276	1068	cmd.exe	87
PID 1068 wrote to memory of 1276	1068	cmd.exe	87
PID 1068 wrote to memory of 1276	1068	cmd.exe	87
PID 712 wrote to memory of 1956	712	DBS_Bank_ Payment Copy_Pdf.exe	88
PID 712 wrote to memory of 1956	712	DBS_Bank_ Payment Copy_Pdf.exe	88
PID 712 wrote to memory of 1956	712	DBS_Bank_ Payment Copy_Pdf.exe	88
PID 1956 wrote to memory of 988	1956	cmd.exe	90
PID 1956 wrote to memory of 988	1956	cmd.exe	90
PID 1956 wrote to memory of 988	1956	cmd.exe	90
PID 712 wrote to memory of 1364	712	DBS_Bank_ Payment Copy_Pdf.exe	91
PID 712 wrote to memory of 1364	712	DBS_Bank_ Payment Copy_Pdf.exe	91
PID 712 wrote to memory of 1364	712	DBS_Bank_ Payment Copy_Pdf.exe	91
PID 1364 wrote to memory of 2376	1364	cmd.exe	93
PID 1364 wrote to memory of 2376	1364	cmd.exe	93
PID 1364 wrote to memory of 2376	1364	cmd.exe	93
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96
PID 712 wrote to memory of 2984	712	DBS_Bank_ Payment Copy_Pdf.exe	96

C:\Users\Admin\AppData\Local\Temp\DBS_Bank_ Payment Copy_Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DBS_Bank_ Payment Copy_Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:3208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:1276
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:2376
- C:\Users\Admin\AppData\Local\Temp\DBS_Bank_ Payment Copy_Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DBS_Bank_ Payment Copy_Pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/712-118-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/712-119-0x00000000057D0000-0x0000000005856000-memory.dmp

Download

memory/712-117-0x0000000004F90000-0x000000000548E000-memory.dmp

Download

memory/712-115-0x0000000000240000-0x0000000000250000-memory.dmp

Download

memory/712-138-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Download

memory/712-116-0x0000000000240000-0x0000000000250000-memory.dmp

Download

memory/712-126-0x0000000005860000-0x000000000586A000-memory.dmp

Download

memory/712-127-0x0000000005920000-0x00000000059B2000-memory.dmp

Download

memory/2984-139-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2984-142-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2984-143-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2984-144-0x0000000005710000-0x0000000005C0E000-memory.dmp

Download

memory/2984-145-0x00000000052B0000-0x000000000534C000-memory.dmp

Download

memory/2984-146-0x0000000005210000-0x000000000570E000-memory.dmp

Download

memory/2984-147-0x0000000005250000-0x0000000005268000-memory.dmp

Download

memory/2984-148-0x0000000005E00000-0x0000000005E66000-memory.dmp

Download