agenttesla | 55f79a0267457cdf7267d3bedb41b02b602ba6602d70e954f4eac4dae4d48de7

Analysis

max time kernel
146s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
factură_de_plată.pdf.exe
Size 647KB
Sample201109-mbs3pr2dpx
SHA256 55f79a0267457cdf7267d3bedb41b02b602ba6602d70e954f4eac4dae4d48de7
MD5 f329915f181d7e4c59cecc808eca2942
SHA1 05edd0473272072d75e4a3afad6e466c9c050e3f
SHA512 c68adbe1f51a1429b559ef82fd307c16b21c046280978cbfd0379fa092f74bd97caa2c86f2f748459b34e3f7233e8fac75617159df7d71b9b799df93cebd8289
MD5 SHA1 SHA512

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.pan-door.gr
Port
21
Username
[email protected]
Password
Playboy123#@!

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.pan-door.gr/
Port
21
Username
[email protected]
Password
Playboy123#@!

Credentials

Protocol
ftp
Host
ftp://ftp.pan-door.gr/
Port
21
Username
[email protected]
Password
Playboy123#@!

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3140-11-0x000000000044C6EE-mapping.dmp	family_agenttesla
behavioral2/memory/3140-13-0x0000000000800000-0x0000000000852000-memory.dmp	family_agenttesla

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/648-3-0x0000000002970000-0x000000000297F000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 3140	648	factură_de_plată.pdf.exe	78

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
648	factură_de_plată.pdf.exe
648	factură_de_plată.pdf.exe
648	factură_de_plată.pdf.exe
3140	AppLaunch.exe
3140	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	factură_de_plată.pdf.exe
Token: SeDebugPrivilege	3140	AppLaunch.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 648 wrote to memory of 3140	648	factură_de_plată.pdf.exe	78
PID 3140 wrote to memory of 1800	3140	AppLaunch.exe	80
PID 3140 wrote to memory of 1800	3140	AppLaunch.exe	80
PID 3140 wrote to memory of 1800	3140	AppLaunch.exe	80

C:\Users\Admin\AppData\Local\Temp\factură_de_plată.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\factură_de_plată.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-9-0x00000000052E0000-0x00000000052E3000-memory.dmp

Download

memory/648-0-0x00000000730E0000-0x00000000737CE000-memory.dmp

Download

memory/648-3-0x0000000002970000-0x000000000297F000-memory.dmp

Download

memory/648-4-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/648-5-0x0000000002980000-0x0000000002982000-memory.dmp

Download

memory/648-6-0x00000000051B0000-0x00000000051B1000-memory.dmp

Download

memory/648-7-0x0000000005190000-0x0000000005192000-memory.dmp

Download

memory/648-8-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/648-1-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3140-13-0x0000000000800000-0x0000000000852000-memory.dmp

Download

memory/3140-16-0x0000000008AD0000-0x0000000008AD1000-memory.dmp

Download

memory/3140-17-0x0000000006420000-0x0000000006421000-memory.dmp

Download

memory/3140-18-0x0000000009690000-0x0000000009691000-memory.dmp

Download

memory/3140-12-0x00000000730E0000-0x00000000737CE000-memory.dmp

Download

memory/3140-21-0x0000000009C40000-0x0000000009C41000-memory.dmp

Download