agenttesla | 4150a9254130775146e1973ba461ffacc7d51365da70db48becba50fbfc1e39d

General

Target

FACTURA_.EXE.exe
Size

710KB
MD5

8670ff57444ced9cc643f4588e41a93e
SHA1

7195dc5aeda6f7f88e32e3aab2c696959c4e42a5
SHA256

4150a9254130775146e1973ba461ffacc7d51365da70db48becba50fbfc1e39d
SHA512

d4948994ac3dfb526a0b03b8c3d442c4254f2145fbe3574f45e4b4bd5ddbc575870ad261de7f92a351808ecb1c8b62ea9c4e86c69ae945c4cb8cccf090c5c0fd
SSDEEP

12288:AsHzOUNUSB/o5LsI1uwajJ5yvv1l2WiqfqVR7idUfRgtdvGmavCbyBW6/:TiUmSB/o5d1ubcvpjbdWgf2W6/

Score

10^/10

agenttesla keylogger spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Drops startup file 1 IoCs

Processes:

DADDY 24.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DADDY 24.vbs DADDY 24.exe
Executes dropped EXE 1 IoCs

Processes:

DADDY 24.exe

pid process

3520 DADDY 24.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DADDY 24.vbs	DADDY 24.exe

pid	process
3520	DADDY 24.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1620-0-0x0000000000190000-0x000000000031F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\directory\DADDY 24.exe	upx
behavioral2/memory/3520-15-0x0000000000D70000-0x0000000000EFF000-memory.dmp	upx
C:\Users\Admin\AppData\Local\directory\DADDY 24.exe	upx
behavioral2/memory/1620-17-0x0000000000190000-0x000000000031F000-memory.dmp	upx
behavioral2/memory/3520-33-0x0000000000D70000-0x0000000000EFF000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/1620-17-0x0000000000190000-0x000000000031F000-memory.dmp	autoit_exe
behavioral2/memory/3520-33-0x0000000000D70000-0x0000000000EFF000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

DADDY 24.exe

description pid process target process

PID 3520 set thread context of 2224 3520 DADDY 24.exe svchost.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

DADDY 24.exe

pid process

3520 DADDY 24.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

FACTURA_.EXE.exeDADDY 24.exe

pid process

1620 FACTURA_.EXE.exe
1620 FACTURA_.EXE.exe
3520 DADDY 24.exe
3520 DADDY 24.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

FACTURA_.EXE.exeDADDY 24.exe

pid process

1620 FACTURA_.EXE.exe
1620 FACTURA_.EXE.exe
3520 DADDY 24.exe
3520 DADDY 24.exe

description	pid	process	target process
PID 3520 set thread context of 2224	3520	DADDY 24.exe	svchost.exe

pid	process
3520	DADDY 24.exe

pid	process
1620	FACTURA_.EXE.exe
1620	FACTURA_.EXE.exe
3520	DADDY 24.exe
3520	DADDY 24.exe

pid	process
1620	FACTURA_.EXE.exe
1620	FACTURA_.EXE.exe
3520	DADDY 24.exe
3520	DADDY 24.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

FACTURA_.EXE.exeDADDY 24.exe

description	pid	process	target process
PID 1620 wrote to memory of 3520	1620	FACTURA_.EXE.exe	DADDY 24.exe
PID 1620 wrote to memory of 3520	1620	FACTURA_.EXE.exe	DADDY 24.exe
PID 1620 wrote to memory of 3520	1620	FACTURA_.EXE.exe	DADDY 24.exe
PID 3520 wrote to memory of 2224	3520	DADDY 24.exe	svchost.exe
PID 3520 wrote to memory of 2224	3520	DADDY 24.exe	svchost.exe
PID 3520 wrote to memory of 2224	3520	DADDY 24.exe	svchost.exe
PID 3520 wrote to memory of 2224	3520	DADDY 24.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\FACTURA_.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\FACTURA_.EXE.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\directory\DADDY 24.exe
  "C:\Users\Admin\AppData\Local\Temp\FACTURA_.EXE.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\FACTURA_.EXE.exe"
    3⤵
    PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\holloing

Filesize
29KB

MD5
9051a40b6ac75f6b5347da6925ecfccd

SHA1
328c6977e8d88b2a606c9a94e46d700df29e8f03

SHA256
c67d018207edfcb91b774d1a63f6eafb864db567b5f3c5a741d56c3c315b8870

SHA512
73fd3b38b41285ae0ebca8b815bb47f4139029173d8d80968b14b184991114174e38bb7f27ca17f020d3f090542b311f64f37c8599c99a39d3412fa8be66e3d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\outbluffed

Filesize
321KB

MD5
c9d48e11c2310c97b41d29cda85d5e98

SHA1
00b37cd3d43d8ff20e6b70ad28fa155729c3327a

SHA256
a31829ce442837ee0fef65dc83d813706446dc22e8fb001f227517d33585f327

SHA512
ffaf91d73f689dfeebe7b6983a675b26f45a1ac5133301757bd57abb90378bda1a0c8bcda2e6bf40896b00278c3840d2957cc02da2d2a253a6848d9b9cf0d1e3

Download Submit
C:\Users\Admin\AppData\Local\directory\DADDY 24.exe

Filesize
4.6MB

MD5
e364bca6c9a9ea2606f3121109b2d92a

SHA1
08c2ad73c20e23823f04f91c74a0cc22d9a9870d

SHA256
8bd203bc477c86d953c9f4344303d283f2442dc8bcdc93ef076bb8472b50c469

SHA512
213f068f08562754b477cee748fc081838441a2f30198fef6eeb6a83ab5d8d1d408eaf62379c06274521e970036b3823d4273ed40b6acc816d0511ecb4397c65

Download Submit
C:\Users\Admin\AppData\Local\directory\DADDY 24.exe

Filesize
4.9MB

MD5
cac791500bbf7df760273abb3219e2d8

SHA1
ede57d1db17512d1f56066d503317df20ba81a92

SHA256
135b55927d76158d5f55a620eb1e6d2f5b9cd44d9042f0802ce8ddca660ec2c8

SHA512
8a6e3aea6be06c78d52b23fd45e681d47fe487446d6a92248d3a24e0f9a5fec51b674a067a7edb785f0574188b291480e415452f1f8cf4ec6349557a7d62d489

Download Submit
memory/1620-11-0x0000000001350000-0x0000000001354000-memory.dmp

Filesize
16KB

Download
memory/1620-0-0x0000000000190000-0x000000000031F000-memory.dmp

Filesize
1.6MB

Download
memory/1620-17-0x0000000000190000-0x000000000031F000-memory.dmp

Filesize
1.6MB

Download
memory/2224-31-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2224-32-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2224-34-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2224-35-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2224-37-0x00000000059C0000-0x0000000005A02000-memory.dmp

Filesize
264KB

Download
memory/2224-36-0x0000000074760000-0x0000000074F10000-memory.dmp

Filesize
7.7MB

Download
memory/2224-38-0x0000000006220000-0x00000000067C4000-memory.dmp

Filesize
5.6MB

Download
memory/3520-15-0x0000000000D70000-0x0000000000EFF000-memory.dmp

Filesize
1.6MB

Download
memory/3520-33-0x0000000000D70000-0x0000000000EFF000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads