agenttesla | a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939

General

Target

a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe
Size

1.0MB
MD5

656aeda4f4a3ad9555f6d88c74fc0705
SHA1

3da5e7c273689cb837de918b39c2650484cd342e
SHA256

a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939
SHA512

d9300bdd48c28c8f148595c6db9dcb20ee19f2f44c524f73f7af1037ca36ecaf239a124ec193143ef76611fd8dbb9f21ff2d456c626865d81ad5ed28dd6e40e3
SSDEEP

24576:BAHnh+eWsN3skA4RV1Hom2KXMmHa5a/M0IQe5:Yh+ZkldoPK8Ya5a/M06

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.worlorderbillions.top
Port:
587
Username:
[email protected]
Password:
##z$P{dTygVX
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2944-11-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2944-13-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2944-20-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2944-17-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2944-11-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2944-13-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2944-20-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2944-17-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2944-11-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2944-13-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2944-20-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2944-17-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2944-11-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2944-13-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2944-20-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2944-17-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2944-11-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2944-13-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2944-20-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2944-17-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2944-11-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2944-13-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2944-20-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2944-17-0x00000000000A0000-0x00000000000E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Suspicious use of SetThreadContext 1 IoCs

Processes:

a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

description	pid	process	target process
PID 2184 set thread context of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2228 2184 WerFault.exe a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2944 RegSvcs.exe
2944 RegSvcs.exe

pid	pid_target	process	target process
2228	2184	WerFault.exe	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

pid	process
2944	RegSvcs.exe
2944	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

pid	process
2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe
2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2944 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2944	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

pid	process
2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe
2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

pid	process
2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe
2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe

description	pid	process	target process
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2944	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	RegSvcs.exe
PID 2184 wrote to memory of 2228	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	WerFault.exe
PID 2184 wrote to memory of 2228	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	WerFault.exe
PID 2184 wrote to memory of 2228	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	WerFault.exe
PID 2184 wrote to memory of 2228	2184	a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe
"C:\Users\Admin\AppData\Local\Temp\a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\a3f5e3e9e01fdd51293410aa65759c2ea0ba6fd96860b6b9e9e0cea139f4d939.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 316
2⤵
- Program crash
PID:2228

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-10-0x00000000000B0000-0x00000000000B4000-memory.dmp

Filesize
16KB

Download
memory/2944-11-0x00000000000A0000-0x00000000000E0000-memory.dmp

Filesize
256KB

Download
memory/2944-13-0x00000000000A0000-0x00000000000E0000-memory.dmp

Filesize
256KB

Download
memory/2944-20-0x00000000000A0000-0x00000000000E0000-memory.dmp

Filesize
256KB

Download
memory/2944-17-0x00000000000A0000-0x00000000000E0000-memory.dmp

Filesize
256KB

Download
memory/2944-21-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-22-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Filesize
256KB

Download
memory/2944-23-0x0000000073E00000-0x00000000744EE000-memory.dmp

Filesize
6.9MB

Download
memory/2944-24-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads