agenttesla | e0ed9ae4533a2a960d0015130b0265f6f93f437c63abaa6a0bb974a5d1cb4b69

General

Target

Order Inquiry for new Purchase_pdf.exe
Size

947KB
MD5

12a0d4a27fb7f7d5f1b345c9e6b171e2
SHA1

6c6c01b4d9023e2f77ea6758b935c656637e5ea2
SHA256

fc44d6c0bc3f20d6e311cbc63e3442fb7f31b2edf039e49ce424549eddfa522d
SHA512

1916f25fd5dca34c3c92c97a0a5ccd9663d1bdce3d00ee23fd5c1dcdc91784fcdba8fb4857c0478f95920f0c9bbe9e422effa2163e724af4343f6c7ae6dd4418
SSDEEP

24576:OeqkD+B877zBtMA0yZqv+D09Pxjlahm8QIPntPG1kYWAXPJ:OeX+xjz8HzYW

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6921829812:AAEnJSJNfX1IyXT3BfHBFaRrW9XkEjVZMFs/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

resource	yara_rule
behavioral2/memory/4108-4-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/4108-4-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with 9Rays.Net Spices.Net Obfuscator. 1 IoCs

resource	yara_rule
behavioral2/memory/464-3-0x0000000002E40000-0x0000000002E4A000-memory.dmp	INDICATOR_EXE_Packed_Spices

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/4108-4-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4108-4-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4108-4-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4108-4-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	api.ipify.org
25	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 464 set thread context of 4108	464	Order Inquiry for new Purchase_pdf.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4108	MSBuild.exe
4108	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	Order Inquiry for new Purchase_pdf.exe
Token: SeDebugPrivilege	4108	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4108	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84
PID 464 wrote to memory of 4108	464	Order Inquiry for new Purchase_pdf.exe	84

C:\Users\Admin\AppData\Local\Temp\Order Inquiry for new Purchase_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order Inquiry for new Purchase_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/464-6-0x00007FF992430000-0x00007FF992EF1000-memory.dmp

Filesize
10.8MB

Download
memory/464-1-0x0000000000C70000-0x0000000000D62000-memory.dmp

Filesize
968KB

Download
memory/464-2-0x00007FF992430000-0x00007FF992EF1000-memory.dmp

Filesize
10.8MB

Download
memory/464-3-0x0000000002E40000-0x0000000002E4A000-memory.dmp

Filesize
40KB

Download
memory/464-0-0x00007FF992433000-0x00007FF992435000-memory.dmp

Filesize
8KB

Download
memory/4108-11-0x00000000069E0000-0x0000000006A30000-memory.dmp

Filesize
320KB

Download
memory/4108-7-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/4108-9-0x00000000055A0000-0x0000000005606000-memory.dmp

Filesize
408KB

Download
memory/4108-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4108-10-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/4108-8-0x00000000059E0000-0x0000000005F84000-memory.dmp

Filesize
5.6MB

Download
memory/4108-12-0x0000000006AD0000-0x0000000006B62000-memory.dmp

Filesize
584KB

Download
memory/4108-13-0x0000000006C60000-0x0000000006C6A000-memory.dmp

Filesize
40KB

Download
memory/4108-14-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/4108-15-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing