agenttesla | 656f08f66aac9f481e1403076c0e88732309d9dc8fe7fba6f1adc4c8e4488f7d

Analysis

max time kernel
48s
max time network
29s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30-03-2023 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

orden de ##compra.exe
Size

449KB
MD5

05ecc56527fcba96bbac7cb98ea2e9fd
SHA1

09e3ec61ae4e9d32f905cadff6e380350eb36c82
SHA256

8bfbb0ea2d51386413aaf7cb64ee4191ebdf511a8c0a07bc6d755376bf014ae8
SHA512

a3e69e632b16ceea3dcfb048f2c3fe24ecb236c29dbaba98449c3f48f67505cecafea32db686a09aa6d5fdcf11732c42b1e2ee99a698b7a6da2c75fb8fd7a2ea
SSDEEP

6144:c/AHjYh29QTrUwbB25+bZ3OV/ijNonSWqivSptk57tt43fN6YNfGewTAya70:XKPtB0+8Uj+zmtkW3sYNfGTA

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mbarieservicesltd.com
Port:
587
Username:
[email protected]
Password:
*o9H+18Q4%;M
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

orden de ##compra.exe

description pid process target process

PID 1268 set thread context of 544 1268 orden de ##compra.exe SetupUtility.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1680 544 WerFault.exe SetupUtility.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

orden de ##compra.exe

pid process

1268 orden de ##compra.exe
1268 orden de ##compra.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

orden de ##compra.exe

description pid process

Token: SeDebugPrivilege 1268 orden de ##compra.exe

description	pid	process	target process
PID 1268 set thread context of 544	1268	orden de ##compra.exe	SetupUtility.exe

pid	pid_target	process	target process
1680	544	WerFault.exe	SetupUtility.exe

pid	process
1268	orden de ##compra.exe
1268	orden de ##compra.exe

description	pid	process
Token: SeDebugPrivilege	1268	orden de ##compra.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

orden de ##compra.exeSetupUtility.exe

description	pid	process	target process
PID 1268 wrote to memory of 760	1268	orden de ##compra.exe	Microsoft.Workflow.Compiler.exe
PID 1268 wrote to memory of 760	1268	orden de ##compra.exe	Microsoft.Workflow.Compiler.exe
PID 1268 wrote to memory of 760	1268	orden de ##compra.exe	Microsoft.Workflow.Compiler.exe
PID 1268 wrote to memory of 860	1268	orden de ##compra.exe	EdmGen.exe
PID 1268 wrote to memory of 860	1268	orden de ##compra.exe	EdmGen.exe
PID 1268 wrote to memory of 860	1268	orden de ##compra.exe	EdmGen.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 1268 wrote to memory of 544	1268	orden de ##compra.exe	SetupUtility.exe
PID 544 wrote to memory of 1680	544	SetupUtility.exe	WerFault.exe
PID 544 wrote to memory of 1680	544	SetupUtility.exe	WerFault.exe
PID 544 wrote to memory of 1680	544	SetupUtility.exe	WerFault.exe
PID 544 wrote to memory of 1680	544	SetupUtility.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\orden de ##compra.exe
"C:\Users\Admin\AppData\Local\Temp\orden de ##compra.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
2⤵
PID:760

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
2⤵
PID:860

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 168
3⤵
- Program crash
PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1268-54-0x0000000000F50000-0x0000000000FC4000-memory.dmp

Filesize
464KB

Download
memory/1268-55-0x0000000000EB0000-0x0000000000F30000-memory.dmp

Filesize
512KB

Download
memory/1268-56-0x00000000002D0000-0x000000000033E000-memory.dmp

Filesize
440KB

Download