agenttesla | fafa7913ac9ff3330896a63b8db3d8e8f88e35a10de8a96dafa570ed29b537d6

General

Target
Ticari Hesap Özetiniz_pdf.exe
Size 629KB
Sample200828-av1extvw6x
SHA256 fafa7913ac9ff3330896a63b8db3d8e8f88e35a10de8a96dafa570ed29b537d6
MD5 51c74b46054573cde7a20f54b4f494c4
SHA1 cacb06821460af9eb16bb073b90370379e4c5efe
SHA512 9bd5f556b319e6526f3e9c0a94ccead7e98b429385d9e64898c991fb61a261b9926b7378279f090696622acf210873dff4855b5f06445ce35197d7de1e6b9153
MD5 SHA1 SHA512

Score

10^/10

keylogger stealer spyware trojan agenttesla

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.hospitalveterinariosur.com
Port
587
Username
[email protected]
Password
HospitalVeterinarioAlSur2018

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

keylogger stealer

resource	yara_rule
behavioral2/memory/1444-0-0x0000000000400000-0x0000000000452000-memory.dmp	agent_tesla
behavioral2/memory/1444-0-0x0000000000400000-0x0000000000452000-memory.dmp	agent_tesla
behavioral2/memory/1444-1-0x000000000044CA1E-mapping.dmp	agent_tesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3104 set thread context of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = ded0c273fe7cd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3104	Ticari Hesap Özetiniz_pdf.exe
3104	Ticari Hesap Özetiniz_pdf.exe
3104	Ticari Hesap Özetiniz_pdf.exe
1444	Ticari Hesap Özetiniz_pdf.exe
1444	Ticari Hesap Özetiniz_pdf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3336	svchost.exe
Token: SeCreatePagefilePrivilege	3336	svchost.exe
Token: SeDebugPrivilege	3104	Ticari Hesap Özetiniz_pdf.exe
Token: SeDebugPrivilege	1444	Ticari Hesap Özetiniz_pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 3104 wrote to memory of 1444	3104	Ticari Hesap Özetiniz_pdf.exe	76
PID 1444 wrote to memory of 2560	1444	Ticari Hesap Özetiniz_pdf.exe	78
PID 1444 wrote to memory of 2560	1444	Ticari Hesap Özetiniz_pdf.exe	78
PID 1444 wrote to memory of 2560	1444	Ticari Hesap Özetiniz_pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Local\Temp\Ticari Hesap Özetiniz_pdf.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-0-0x0000000000400000-0x0000000000452000-memory.dmp

Download

Analysis

Sharing