agenttesla | f9c1e5fdb85cde83b31fd3777cc1246283b4a942164aa465366c088e0187e1b7

General

Target

4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
Size

727KB
MD5

bc813828d08b596681681296a9e17eb6
SHA1

245133d9baef52591ff6ec3f310b729eceaf47fd
SHA256

4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5
SHA512

2081dc57e4c629c2cbf1483d44b97a191b89775a9ae6c7b19e3b800f28c7707d0785fceb0d307c85c96652d85836ed0adf713ce3600e96b1c4952eaacad2beee
SSDEEP

12288:/14CMwLXXZLdbHDQThYmKwN8B5vKgVTnuRz+yd3qwabuyHHePcQgoeVMAskR:fXXZGu9vKgVTuRCylqwn7PVgfVX

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.thanhancompony.com
Port:
587
Username:
[email protected]
Password:
aSkIhV^3
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

description	pid	process	target process
PID 2272 set thread context of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

pid	process
1316	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
1316	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

description pid process

Token: SeDebugPrivilege 1316 4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

pid process

1316 4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

description	pid	process
Token: SeDebugPrivilege	1316	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

description	pid	process	target process
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
PID 2272 wrote to memory of 1316	2272	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe	4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe

C:\Users\Admin\AppData\Local\Temp\4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
"C:\Users\Admin\AppData\Local\Temp\4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2272

C:\Users\Admin\AppData\Local\Temp\4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe
"C:\Users\Admin\AppData\Local\Temp\4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

4

T1552

Credentials In Files

3

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

4

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1316-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1316-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1316-23-0x0000000004980000-0x00000000049C0000-memory.dmp

Filesize
256KB

Download
memory/1316-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1316-22-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/1316-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1316-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1316-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1316-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2272-4-0x0000000000650000-0x000000000065C000-memory.dmp

Filesize
48KB

Download
memory/2272-1-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2272-0-0x00000000002D0000-0x0000000000386000-memory.dmp

Filesize
728KB

Download
memory/2272-18-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2272-2-0x00000000044B0000-0x00000000044F0000-memory.dmp

Filesize
256KB

Download
memory/2272-5-0x00000000052B0000-0x0000000005334000-memory.dmp

Filesize
528KB

Download
memory/2272-3-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads