agenttesla | 82fed36e33e28ea2575e1d8e17ab4b34f03f72903f7b48ddaec1e2d021bb2c6d

Analysis

max time kernel
85s
max time network
114s
platform
windows10_x64
resource
win10
submitted
02/09/2020, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bank Receipt.pdf.exe
Size 554KB
Sample200902-zkccysc9se
SHA256 82fed36e33e28ea2575e1d8e17ab4b34f03f72903f7b48ddaec1e2d021bb2c6d
MD5 ed5db7c8c76ae2a96a1e828771c39cce
SHA1 a558c9d39d87778b137d35d54c5f5c5790053881
SHA512 aa2d4fc5cef1987582f16cabc36df4306c9e3a1b182fd5c43cecc79c57e4665bdf9e49fe865b6d79d45111a3f11e6ea007d929d4d3db5cdee1f4307e19e81228
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
H(FPf]j;OgNA

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1548-11-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral2/memory/1548-12-0x0000000000454C0E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 1548	3920	Bank Receipt.pdf.exe	76

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 6fe02ee7f180d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3920	Bank Receipt.pdf.exe
3920	Bank Receipt.pdf.exe
3920	Bank Receipt.pdf.exe
1548	RegSvcs.exe
1548	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2596	svchost.exe
Token: SeCreatePagefilePrivilege	2596	svchost.exe
Token: SeDebugPrivilege	3920	Bank Receipt.pdf.exe
Token: SeDebugPrivilege	1548	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76
PID 3920 wrote to memory of 1548	3920	Bank Receipt.pdf.exe	76

C:\Users\Admin\AppData\Local\Temp\Bank Receipt.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Receipt.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-11-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/1548-19-0x0000000005C80000-0x0000000005C81000-memory.dmp

Download

memory/1548-18-0x0000000005070000-0x0000000005071000-memory.dmp

Download

memory/1548-13-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/3920-7-0x00000000070B0000-0x00000000070B1000-memory.dmp

Download

memory/3920-0-0x00000000735B0000-0x0000000073C9E000-memory.dmp

Download

memory/3920-8-0x0000000007500000-0x0000000007571000-memory.dmp

Download

memory/3920-9-0x0000000007620000-0x0000000007621000-memory.dmp

Download

memory/3920-10-0x0000000009CD0000-0x0000000009D48000-memory.dmp

Download

memory/3920-6-0x0000000005140000-0x0000000005143000-memory.dmp

Download

memory/3920-5-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/3920-4-0x0000000004D40000-0x0000000004D41000-memory.dmp

Download

memory/3920-3-0x0000000005320000-0x0000000005321000-memory.dmp

Download

memory/3920-1-0x0000000000440000-0x0000000000441000-memory.dmp

Download