agenttesla | 3b3a509fada9d3a1222d0d0f95e1f3b2f107ba2078c95dcede6173d8b21c52cb

General

Target

Payment Copy.exe
Size

449KB
MD5

6be41600e1ac87f09c86fbf87a00a31d
SHA1

1d1bac713ef177bb77e87a5f424fb4bf82eb778e
SHA256

0b43d1a92167c5579fcf6143418d0195b36be0bd7eaf8ce644d3ba344dd92936
SHA512

be968126085df8a67670558b22259812d7f16d70e6deff7f01405f626ccf2261cfa5992ac9f238bb60633f75eb049327bd2899948998234c8165dc54a9adf61e

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
faith12AB

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
faith12AB

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2244-132-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment Copy.exe

description pid process target process

PID 1204 set thread context of 2244 1204 Payment Copy.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

2244 MSBuild.exe
2244 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2244 MSBuild.exe

description	pid	process	target process
PID 1204 set thread context of 2244	1204	Payment Copy.exe	MSBuild.exe

pid	process
2244	MSBuild.exe
2244	MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2244	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Payment Copy.exeMSBuild.exe

description	pid	process	target process
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 1204 wrote to memory of 2244	1204	Payment Copy.exe	MSBuild.exe
PID 2244 wrote to memory of 3868	2244	MSBuild.exe	netsh.exe
PID 2244 wrote to memory of 3868	2244	MSBuild.exe	netsh.exe
PID 2244 wrote to memory of 3868	2244	MSBuild.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

Processes:

MSBuild.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2244

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:3868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-130-0x0000000074F90000-0x0000000075541000-memory.dmp

Filesize
5.7MB

Download
memory/2244-131-0x0000000000000000-mapping.dmp

Download
memory/2244-132-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2244-133-0x0000000074F90000-0x0000000075541000-memory.dmp

Filesize
5.7MB

Download
memory/3868-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads