agenttesla | 98b003566db6017d0284210e27d136a58b89bac6d253b27cbdd99f2037ba581f

General

Target

eInvoicing_pdf.exe
Size

576KB
MD5

e594c02c881005eadcb788388aff6c5f
SHA1

0f31c21f87b03662e75613631ecee68054b3aab0
SHA256

98b003566db6017d0284210e27d136a58b89bac6d253b27cbdd99f2037ba581f
SHA512

8c39729165bb537b3c58820311b04811852a620308427f4d6de58caaa460ac1688029995c443b7a6c761fb58e24dacef5e1914d200b859f758e9f18c1cec5a85

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flood-protection.org
Port:
587
Username:
diamond@flood-protection.org
Password:
diamond2424@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1476-3-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1476-4-0x00000000004468DE-mapping.dmp	family_agenttesla
behavioral1/memory/1476-5-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1476-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

eInvoicing_pdf.exe

description pid process target process

PID 1060 set thread context of 1476 1060 eInvoicing_pdf.exe eInvoicing_pdf.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

eInvoicing_pdf.exeeInvoicing_pdf.exe

pid process

1060 eInvoicing_pdf.exe
1060 eInvoicing_pdf.exe
1060 eInvoicing_pdf.exe
1476 eInvoicing_pdf.exe
1476 eInvoicing_pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

eInvoicing_pdf.exeeInvoicing_pdf.exe

description pid process

Token: SeDebugPrivilege 1060 eInvoicing_pdf.exe
Token: SeDebugPrivilege 1476 eInvoicing_pdf.exe

description	pid	process	target process
PID 1060 set thread context of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe

pid	process
1060	eInvoicing_pdf.exe
1060	eInvoicing_pdf.exe
1060	eInvoicing_pdf.exe
1476	eInvoicing_pdf.exe
1476	eInvoicing_pdf.exe

description	pid	process
Token: SeDebugPrivilege	1060	eInvoicing_pdf.exe
Token: SeDebugPrivilege	1476	eInvoicing_pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

eInvoicing_pdf.exe

description	pid	process	target process
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe
PID 1060 wrote to memory of 1476	1060	eInvoicing_pdf.exe	eInvoicing_pdf.exe

C:\Users\Admin\AppData\Local\Temp\eInvoicing_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\eInvoicing_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060

C:\Users\Admin\AppData\Local\Temp\eInvoicing_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\eInvoicing_pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-1-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/1476-3-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1476-4-0x00000000004468DE-mapping.dmp

Download
memory/1476-5-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1476-6-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing