agenttesla | 86a618fcaba9df35ca00ddea1978760b2f92e5b4a9c2ab749d79464e4c03dc2b

General

Target

CamScan_20231212.exe
Size

334KB
MD5

2fd135ea0c3a82e9e4429f740563f977
SHA1

1617b00ee26f17e8484917d6379cfa50580b90e1
SHA256

86a618fcaba9df35ca00ddea1978760b2f92e5b4a9c2ab749d79464e4c03dc2b
SHA512

a885747cd74100fe55646eb2052e9d2f4bf32c5a92b75ee4843a21b6b3ae072e4a516df3ba719ca9eec5782ee57a574d0b0ba3dd51075d7e321216f2b66dea92
SSDEEP

6144:2uskkWEoPObzIdbgnCpNXF4ZRmyYH/b8NNIk/1Pvxo4zI4gqV7BtXlee2TeU:2ua/bibzL/Zk/5Jo4zTJRD2q

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6669461375:AAGwrSGDuGS4lzGe3ziI4ubZc9TzQ8r1m8o/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

Processes:

CamScan_20231212.exe

description	pid	process	target process
PID 1040 set thread context of 4980	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 set thread context of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

840 4980 WerFault.exe CamScan_20231212.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CamScan_20231212.exe

pid process

2080 CamScan_20231212.exe
2080 CamScan_20231212.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CamScan_20231212.exe

description pid process

Token: SeDebugPrivilege 2080 CamScan_20231212.exe

pid	pid_target	process	target process
840	4980	WerFault.exe	CamScan_20231212.exe

pid	process
2080	CamScan_20231212.exe
2080	CamScan_20231212.exe

description	pid	process
Token: SeDebugPrivilege	2080	CamScan_20231212.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

CamScan_20231212.exe

description	pid	process	target process
PID 1040 wrote to memory of 4980	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 4980	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 4980	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 4980	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe
PID 1040 wrote to memory of 2080	1040	CamScan_20231212.exe	CamScan_20231212.exe

C:\Users\Admin\AppData\Local\Temp\CamScan_20231212.exe
"C:\Users\Admin\AppData\Local\Temp\CamScan_20231212.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040

C:\Users\Admin\AppData\Local\Temp\CamScan_20231212.exe
"C:\Users\Admin\AppData\Local\Temp\CamScan_20231212.exe"
2⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 80
3⤵
- Program crash
PID:840

C:\Users\Admin\AppData\Local\Temp\CamScan_20231212.exe
"C:\Users\Admin\AppData\Local\Temp\CamScan_20231212.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4980 -ip 4980
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1040-0-0x00000000003B0000-0x0000000000408000-memory.dmp

Filesize
352KB

Download
memory/1040-1-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/1040-2-0x0000000005260000-0x0000000005804000-memory.dmp

Filesize
5.6MB

Download
memory/1040-3-0x0000000004DA0000-0x0000000004E32000-memory.dmp

Filesize
584KB

Download
memory/1040-4-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/1040-6-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/1040-11-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-9-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2080-8-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-10-0x0000000004D70000-0x0000000004DD6000-memory.dmp

Filesize
408KB

Download
memory/2080-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2080-12-0x0000000005B10000-0x0000000005B60000-memory.dmp

Filesize
320KB

Download
memory/2080-13-0x0000000005C00000-0x0000000005C9C000-memory.dmp

Filesize
624KB

Download
memory/2080-14-0x0000000006630000-0x000000000663A000-memory.dmp

Filesize
40KB

Download
memory/2080-15-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/2080-16-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing