agenttesla | 4988b00c252410f05a2bd1d8202739be301c54e4bbac08c4ddbb704a8d660e8d

General

Target

RFQ_6000042792.PDF.exe
Size

435KB
MD5

e9204b04d38a5e0f5fcce7a195e88fe7
SHA1

b0b84a3f8afac504d74f75af0d252d30ce7bacdf
SHA256

4988b00c252410f05a2bd1d8202739be301c54e4bbac08c4ddbb704a8d660e8d
SHA512

9297da618ff863439586b19f04a0ec66b9b5f8be08703a94d727145a326e494b57c4c2e169ae9bbec19e5ff4c17899e453ca4c0194c597960ac2c6dbfbc130de

Score

10^/10

spyware keylogger trojan stealer agenttesla

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.portsen.com
Port:
587
Username:
bnno@portsen.com
Password:
Nkhp*pE1

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RFQ_6000042792.PDF.exeRFQ_6000042792.PDF.exe

description pid process

Token: SeDebugPrivilege 3888 RFQ_6000042792.PDF.exe
Token: SeDebugPrivilege 3484 RFQ_6000042792.PDF.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RFQ_6000042792.PDF.exe

pid process

3484 RFQ_6000042792.PDF.exe
3484 RFQ_6000042792.PDF.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

description	pid	process
Token: SeDebugPrivilege	3888	RFQ_6000042792.PDF.exe
Token: SeDebugPrivilege	3484	RFQ_6000042792.PDF.exe

pid	process
3484	RFQ_6000042792.PDF.exe
3484	RFQ_6000042792.PDF.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

RFQ_6000042792.PDF.exe

description	pid	process	target process
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe
PID 3888 wrote to memory of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ_6000042792.PDF.exe

description pid process target process

PID 3888 set thread context of 3484 3888 RFQ_6000042792.PDF.exe RFQ_6000042792.PDF.exe

description	pid	process	target process
PID 3888 set thread context of 3484	3888	RFQ_6000042792.PDF.exe	RFQ_6000042792.PDF.exe

C:\Users\Admin\AppData\Local\Temp\RFQ_6000042792.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_6000042792.PDF.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3888

C:\Users\Admin\AppData\Local\Temp\RFQ_6000042792.PDF.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RFQ_6000042792.PDF.exe.log

Download Submit
memory/3484-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3484-1-0x00000000004472DE-mapping.dmp

Download

Analysis

Sharing