agenttesla | 5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7

General

Target

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
Size

476KB
MD5

2f2984690e83994f56545ed93bbfe557
SHA1

aa3a0b86b160f19072a2db2afa186f761a9569eb
SHA256

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7
SHA512

ef1f0840522e32fd6d94fee8182e64d0018032b87105cc01e5c270d7cd6c63e4643b827d81f5e6e684358a78f6acf1c6526f40cdb9212b100fabc06fc38d3159
SSDEEP

12288:gYR/SQVieUH3JagG3R/5+MQLOtD3lfAZnrehQF:XR/SQVi7H3JagWMONVotri2

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.allenqers.net
Port:
587
Username:
[email protected]
Password:
stanstan22

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1700-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-64-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral1/memory/1700-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1700-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1612-56-0x0000000000B80000-0x0000000000BEC000-memory.dmp	beds_protector

Drops file in Drivers directory 1 IoCs

Processes:

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\kprUEGC = "C:\\Users\\Admin\\AppData\\Roaming\\kprUEGC\\kprUEGC.exe"	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

description	pid	process	target process
PID 1612 set thread context of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

pid	process
1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
1700	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
1700	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

description	pid	process
Token: SeDebugPrivilege	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
Token: SeDebugPrivilege	1700	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

description	pid	process	target process
PID 1612 wrote to memory of 2020	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 2020	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 2020	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 2020	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
PID 1612 wrote to memory of 1700	1612	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe	5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe

C:\Users\Admin\AppData\Local\Temp\5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
"C:\Users\Admin\AppData\Local\Temp\5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
"C:\Users\Admin\AppData\Local\Temp\5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe"
2⤵
PID:2020

C:\Users\Admin\AppData\Local\Temp\5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe
"C:\Users\Admin\AppData\Local\Temp\5895a31246f72f8ea9458911dbe7b14741618faa9c9bfc33baf697031103ecf7.exe"
2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-54-0x0000000001290000-0x000000000130E000-memory.dmp

Filesize
504KB

Download
memory/1612-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-56-0x0000000000B80000-0x0000000000BEC000-memory.dmp

Filesize
432KB

Download
memory/1612-57-0x0000000000360000-0x0000000000376000-memory.dmp

Filesize
88KB

Download
memory/1700-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-59-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-62-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-64-0x000000000043761E-mapping.dmp

Download
memory/1700-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1700-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads