agenttesla | 32dbfe6f42c146969736602b95b0886e6c66e68c36d24e97c45ac6b9f9d490b1

Analysis

max time kernel
92s
max time network
121s
platform
windows10_x64
resource
win10v200722
submitted
09/09/2020, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTE B1018500.pdf.exe
Size 719KB
Sample200909-6yncvgeefe
SHA256 32dbfe6f42c146969736602b95b0886e6c66e68c36d24e97c45ac6b9f9d490b1
MD5 7031cc1f86b59fb91dfbe407b8241d70
SHA1 91c091f7b1c7314b2e8ad650d3f7d4260e88c9fc
SHA512 be0bb1cfa8abf4f763b98455cacb2d75d597847f3edceee2dc73b30e6c2ee4ee4ad8a0aef3c6230845c14386235102671b49ec15f1317c9300740e9c3a1dc8fb
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
H(FPf]j;OgNA

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3940-11-0x0000000000400000-0x000000000045A000-memory.dmp	family_agenttesla
behavioral2/memory/3940-12-0x0000000000454C0E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 3940	3908	QUOTE B1018500.pdf.exe	75

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 4d0d31718586d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3908	QUOTE B1018500.pdf.exe
3908	QUOTE B1018500.pdf.exe
3908	QUOTE B1018500.pdf.exe
3940	RegSvcs.exe
3940	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1888	svchost.exe
Token: SeCreatePagefilePrivilege	1888	svchost.exe
Token: SeDebugPrivilege	3908	QUOTE B1018500.pdf.exe
Token: SeDebugPrivilege	3940	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75
PID 3908 wrote to memory of 3940	3908	QUOTE B1018500.pdf.exe	75

C:\Users\Admin\AppData\Local\Temp\QUOTE B1018500.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE B1018500.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3908-0-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Download

memory/3908-1-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/3908-3-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Download

memory/3908-4-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/3908-5-0x00000000053F0000-0x00000000053F1000-memory.dmp

Download

memory/3908-6-0x00000000054E0000-0x00000000054E3000-memory.dmp

Download

memory/3908-7-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

Download

memory/3908-8-0x0000000006630000-0x00000000066CC000-memory.dmp

Download

memory/3908-9-0x0000000006770000-0x0000000006771000-memory.dmp

Download

memory/3908-10-0x0000000008CD0000-0x0000000008D69000-memory.dmp

Download

memory/3940-11-0x0000000000400000-0x000000000045A000-memory.dmp

Download

memory/3940-13-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Download

memory/3940-18-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/3940-19-0x00000000060C0000-0x00000000060C1000-memory.dmp

Download