agenttesla | 479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24

General

Target

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
Size

718KB
MD5

4723100da4878c6e30761960809f1d5d
SHA1

09440545558fde0df0ce5a604921d1666b8dadfe
SHA256

479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24
SHA512

86fab8dcf491e352eb2beeb0c1f8046f72625a459578e6c421dab0b1f3599547833b73572b1bf5661c3d12eecb1e7c8c8cc8465b5e805d25f744045cce1aed03

Score

10^/10

agenttesla metastealer keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.sonoscepa.net
Port:
587
Username:
[email protected]
Password:
VOxcBxxb6

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4332-131-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe"	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4276 set thread context of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
4332	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
4332	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
Token: SeDebugPrivilege	4332	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92
PID 4276 wrote to memory of 4332	4276	479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe	92

C:\Users\Admin\AppData\Local\Temp\479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
"C:\Users\Admin\AppData\Local\Temp\479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Local\Temp\479f557c555bdd70bfcb8cb9c39703ea5dceed4bc145c2695babf3e18b737a24.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4276-124-0x00000000004F0000-0x00000000005AA000-memory.dmp

Filesize
744KB

Download
memory/4276-125-0x0000000009AB0000-0x000000000A054000-memory.dmp

Filesize
5.6MB

Download
memory/4276-126-0x0000000005180000-0x0000000005212000-memory.dmp

Filesize
584KB

Download
memory/4276-127-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/4276-128-0x0000000008A30000-0x0000000008F5C000-memory.dmp

Filesize
5.2MB

Download
memory/4276-129-0x00000000085A0000-0x000000000863C000-memory.dmp

Filesize
624KB

Download
memory/4332-131-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4332-132-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing