agenttesla | 5da4cf63dd4a039633f0ae7091efc702e660369493464956d74979a0d6c6e982

General

Target

RFQ_ENQ-02334.PDF.exe
Size

974KB
MD5

e092a6cf776c1b9c6f16287d6caa7ec6
SHA1

4243d1993af0b5c46f8ed14b234fd093440319c7
SHA256

5da4cf63dd4a039633f0ae7091efc702e660369493464956d74979a0d6c6e982
SHA512

e3f38290dfa5630b7aa85fdba1a006817846f297baa67dbd37435286dfe085c1e05a1e9a59e31d35831b172b4590ca961f2fb2778076605b7fb829facd394739

Score

10^/10

spyware persistence keylogger trojan stealer agenttesla

Malware Config

Signatures

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies service 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

netsh.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	netsh.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	netsh.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RFQ_ENQ-02334.PDF.exeRFQ_ENQ-02334.PDF.exe

pid process

1456 RFQ_ENQ-02334.PDF.exe
828 RFQ_ENQ-02334.PDF.exe
828 RFQ_ENQ-02334.PDF.exe

pid	process
1456	RFQ_ENQ-02334.PDF.exe
828	RFQ_ENQ-02334.PDF.exe
828	RFQ_ENQ-02334.PDF.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

RFQ_ENQ-02334.PDF.exeRFQ_ENQ-02334.PDF.exe

description	pid	process	target process
PID 1456 wrote to memory of 1488	1456	RFQ_ENQ-02334.PDF.exe	notepad.exe
PID 1456 wrote to memory of 1488	1456	RFQ_ENQ-02334.PDF.exe	notepad.exe
PID 1456 wrote to memory of 1488	1456	RFQ_ENQ-02334.PDF.exe	notepad.exe
PID 1456 wrote to memory of 1488	1456	RFQ_ENQ-02334.PDF.exe	notepad.exe
PID 1456 wrote to memory of 1488	1456	RFQ_ENQ-02334.PDF.exe	notepad.exe
PID 1456 wrote to memory of 1488	1456	RFQ_ENQ-02334.PDF.exe	notepad.exe
PID 1456 wrote to memory of 828	1456	RFQ_ENQ-02334.PDF.exe	RFQ_ENQ-02334.PDF.exe
PID 1456 wrote to memory of 828	1456	RFQ_ENQ-02334.PDF.exe	RFQ_ENQ-02334.PDF.exe
PID 1456 wrote to memory of 828	1456	RFQ_ENQ-02334.PDF.exe	RFQ_ENQ-02334.PDF.exe
PID 1456 wrote to memory of 828	1456	RFQ_ENQ-02334.PDF.exe	RFQ_ENQ-02334.PDF.exe
PID 828 wrote to memory of 1800	828	RFQ_ENQ-02334.PDF.exe	netsh.exe
PID 828 wrote to memory of 1800	828	RFQ_ENQ-02334.PDF.exe	netsh.exe
PID 828 wrote to memory of 1800	828	RFQ_ENQ-02334.PDF.exe	netsh.exe
PID 828 wrote to memory of 1800	828	RFQ_ENQ-02334.PDF.exe	netsh.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

RFQ_ENQ-02334.PDF.exe

pid process

1456 RFQ_ENQ-02334.PDF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ_ENQ-02334.PDF.exe

description pid process

Token: SeDebugPrivilege 828 RFQ_ENQ-02334.PDF.exe

pid	process
1456	RFQ_ENQ-02334.PDF.exe

description	pid	process
Token: SeDebugPrivilege	828	RFQ_ENQ-02334.PDF.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/828-2-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral1/memory/828-4-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral1/memory/828-5-0x0000000000400000-0x00000000004B0000-memory.dmp	upx

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RFQ_ENQ-02334.PDF.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\uEtmoKl = "C:\\Users\\Admin\\AppData\\Roaming\\uEtmoKl\\uEtmoKl.exe"	RFQ_ENQ-02334.PDF.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ_ENQ-02334.PDF.exe

description pid process target process

PID 1456 set thread context of 828 1456 RFQ_ENQ-02334.PDF.exe RFQ_ENQ-02334.PDF.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Drops startup file 1 IoCs

Processes:

notepad.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Doc.vbs notepad.exe

description	pid	process	target process
PID 1456 set thread context of 828	1456	RFQ_ENQ-02334.PDF.exe	RFQ_ENQ-02334.PDF.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Doc.vbs	notepad.exe

C:\Users\Admin\AppData\Local\Temp\RFQ_ENQ-02334.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_ENQ-02334.PDF.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1456

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
2⤵
- Drops startup file
PID:1488

C:\Users\Admin\AppData\Local\Temp\RFQ_ENQ-02334.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_ENQ-02334.PDF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
PID:828

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
- Modifies service
PID:1800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-2-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/828-3-0x00000000004AE260-mapping.dmp

Download
memory/828-4-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/828-5-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/828-6-0x0000000000370000-0x00000000003C2000-memory.dmp

Filesize
328KB

Download
memory/828-7-0x0000000001FC2000-0x0000000001FC3000-memory.dmp

Filesize
4KB

Download
memory/828-8-0x0000000000220000-0x000000000026C000-memory.dmp

Filesize
304KB

Download
memory/1488-1-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1488-0-0x0000000000000000-mapping.dmp

Download
memory/1800-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads