agenttesla | 69f8a5c1c6cc3a38c16323205d857f376e0f8831f0fb4de555b736fd237cd646

General

Target

SOA.exe
Size

486KB
MD5

8083a9f113f6ee458ec96ae28c423ffc
SHA1

f6a0b2a4f1d86181771f1f71850a5ae682e62dc1
SHA256

286746a21e00a444f5dba54bf184545a1a8a5c5c5d813139f130ee0940d0009f
SHA512

e496fbb0afeed32c7f6f9044ae113201d17cd6bb941a4bcda53dc62fbcfff4baabfb77ba237fcc628b948a9fbc4fcdb2d12955476a2d1af8681f273a7f8dcbcc

Score

10^/10

agenttesla evasion keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.rajapindah.com
Port:
587
Username:
[email protected]
Password:
#r4j#citeureup#13

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4512-138-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Disables Task Manager via registry modification
evasion
Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

SOA.exe

description pid process target process

PID 4316 set thread context of 4512 4316 SOA.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

620 4512 WerFault.exe RegSvcs.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

4172 REG.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

SOA.exeRegSvcs.exe

pid process

4316 SOA.exe
4316 SOA.exe
4316 SOA.exe
4316 SOA.exe
4512 RegSvcs.exe
4512 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SOA.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 4316 SOA.exe
Token: SeDebugPrivilege 4512 RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

description	pid	process	target process
PID 4316 set thread context of 4512	4316	SOA.exe	RegSvcs.exe

pid	pid_target	process	target process
620	4512	WerFault.exe	RegSvcs.exe

pid	process
4172	REG.exe

pid	process
4316	SOA.exe
4316	SOA.exe
4316	SOA.exe
4316	SOA.exe
4512	RegSvcs.exe
4512	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	4316	SOA.exe
Token: SeDebugPrivilege	4512	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

SOA.exeRegSvcs.exe

description	pid	process	target process
PID 4316 wrote to memory of 2280	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 2280	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 2280	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4364	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4364	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4364	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4316 wrote to memory of 4512	4316	SOA.exe	RegSvcs.exe
PID 4512 wrote to memory of 4172	4512	RegSvcs.exe	REG.exe
PID 4512 wrote to memory of 4172	4512	RegSvcs.exe	REG.exe
PID 4512 wrote to memory of 4172	4512	RegSvcs.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:2280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:4364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1512
3⤵
- Program crash
PID:620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4512 -ip 4512
1⤵
PID:3924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-135-0x0000000000000000-mapping.dmp

Download
memory/4172-140-0x0000000000000000-mapping.dmp

Download
memory/4316-130-0x00000000000A0000-0x0000000000120000-memory.dmp

Filesize
512KB

Download
memory/4316-131-0x0000000005150000-0x00000000056F4000-memory.dmp

Filesize
5.6MB

Download
memory/4316-132-0x0000000004AC0000-0x0000000004B52000-memory.dmp

Filesize
584KB

Download
memory/4316-133-0x0000000004B60000-0x0000000004B6A000-memory.dmp

Filesize
40KB

Download
memory/4316-134-0x0000000008510000-0x00000000085AC000-memory.dmp

Filesize
624KB

Download
memory/4364-136-0x0000000000000000-mapping.dmp

Download
memory/4512-137-0x0000000000000000-mapping.dmp

Download
memory/4512-138-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4512-139-0x0000000005D00000-0x0000000005D66000-memory.dmp

Filesize
408KB

Download
memory/4512-141-0x00000000060F0000-0x0000000006140000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing