agenttesla | 54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7

General

Target

0093847642020copy_pdf.exe
Size

437KB
MD5

e3a86615deaec978525332219ef8079f
SHA1

8781c4b55d8e3e66458f3e3584ebf98821ae1018
SHA256

54bd5cfab1dd37a3b3c905c14768d9f2465e770a69dc0c057c2193c9ceeabed7
SHA512

1bc33eec1c77d6a6e923ab5e67d39214e4ad2202efbc02675a0c2b4491e330d71ddb585f4397c76dc3662e14e84e6b3249a9c8a115087cb5a0ae6503ade0e53f

Score

10^/10

spyware keylogger trojan stealer agenttesla

Malware Config

Signatures

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

0093847642020copy_pdf.exe

description	pid	process	target process
PID 1500 wrote to memory of 1792	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1792	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1792	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1792	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe
PID 1500 wrote to memory of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0093847642020copy_pdf.exe0093847642020copy_pdf.exe

description pid process

Token: SeDebugPrivilege 1500 0093847642020copy_pdf.exe
Token: SeDebugPrivilege 1808 0093847642020copy_pdf.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

0093847642020copy_pdf.exe0093847642020copy_pdf.exe

pid process

1500 0093847642020copy_pdf.exe
1500 0093847642020copy_pdf.exe
1808 0093847642020copy_pdf.exe
1808 0093847642020copy_pdf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

0093847642020copy_pdf.exe

description pid process target process

PID 1500 set thread context of 1808 1500 0093847642020copy_pdf.exe 0093847642020copy_pdf.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process
Token: SeDebugPrivilege	1500	0093847642020copy_pdf.exe
Token: SeDebugPrivilege	1808	0093847642020copy_pdf.exe

pid	process
1500	0093847642020copy_pdf.exe
1500	0093847642020copy_pdf.exe
1808	0093847642020copy_pdf.exe
1808	0093847642020copy_pdf.exe

description	pid	process	target process
PID 1500 set thread context of 1808	1500	0093847642020copy_pdf.exe	0093847642020copy_pdf.exe

C:\Users\Admin\AppData\Local\Temp\0093847642020copy_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\0093847642020copy_pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1500

C:\Users\Admin\AppData\Local\Temp\0093847642020copy_pdf.exe
"{path}"
2⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\0093847642020copy_pdf.exe
"{path}"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1808-1-0x000000000044741E-mapping.dmp

Download
memory/1808-2-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1808-3-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing