agenttesla | 1ecb56fae94db17332e267fa2d786083ac82329386f8405152768cd231a40a57

Analysis

max time kernel
12s
max time network
14s
platform
windows7_x64
resource
win7v20201028
submitted
26-01-2021 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AWB 9899691012 TRACKING INFO_pdf.exe
Size

707KB
MD5

6bbf880c0fc2abd697d148b7802a449e
SHA1

bf8aed9228f88f7ddfb2722305c9cc099d488ad6
SHA256

1ecb56fae94db17332e267fa2d786083ac82329386f8405152768cd231a40a57
SHA512

611b597733de78200fef28e53a4453dc84f9ccb1dedec2051382497a0bc372decef0763509937ed6c9eb5436486a07a392dc75a44f432b7291282b1b1e882742

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2028-15-0x0000000000400000-0x000000000044B000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

Processes:

qawifxae.exeim8h3047xu.exe

pid process

836 qawifxae.exe
2028 im8h3047xu.exe
Loads dropped DLL 5 IoCs

Processes:

AWB 9899691012 TRACKING INFO_pdf.exeqawifxae.exedw20.exe

pid process

1648 AWB 9899691012 TRACKING INFO_pdf.exe
836 qawifxae.exe
900 dw20.exe
900 dw20.exe
900 dw20.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

qawifxae.exe

description pid process target process

PID 836 set thread context of 2028 836 qawifxae.exe im8h3047xu.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

qawifxae.exeim8h3047xu.exe

pid process

836 qawifxae.exe
836 qawifxae.exe
836 qawifxae.exe
836 qawifxae.exe
2028 im8h3047xu.exe
2028 im8h3047xu.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

qawifxae.exe

pid process

836 qawifxae.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

im8h3047xu.exe

description pid process

Token: SeDebugPrivilege 2028 im8h3047xu.exe

pid	process
836	qawifxae.exe
2028	im8h3047xu.exe

pid	process
1648	AWB 9899691012 TRACKING INFO_pdf.exe
836	qawifxae.exe
900	dw20.exe
900	dw20.exe
900	dw20.exe

description	pid	process	target process
PID 836 set thread context of 2028	836	qawifxae.exe	im8h3047xu.exe

pid	process
836	qawifxae.exe
836	qawifxae.exe
836	qawifxae.exe
836	qawifxae.exe
2028	im8h3047xu.exe
2028	im8h3047xu.exe

pid	process
836	qawifxae.exe

description	pid	process
Token: SeDebugPrivilege	2028	im8h3047xu.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

AWB 9899691012 TRACKING INFO_pdf.exeqawifxae.exeim8h3047xu.exe

description	pid	process	target process
PID 1648 wrote to memory of 836	1648	AWB 9899691012 TRACKING INFO_pdf.exe	qawifxae.exe
PID 1648 wrote to memory of 836	1648	AWB 9899691012 TRACKING INFO_pdf.exe	qawifxae.exe
PID 1648 wrote to memory of 836	1648	AWB 9899691012 TRACKING INFO_pdf.exe	qawifxae.exe
PID 1648 wrote to memory of 836	1648	AWB 9899691012 TRACKING INFO_pdf.exe	qawifxae.exe
PID 836 wrote to memory of 2028	836	qawifxae.exe	im8h3047xu.exe
PID 836 wrote to memory of 2028	836	qawifxae.exe	im8h3047xu.exe
PID 836 wrote to memory of 2028	836	qawifxae.exe	im8h3047xu.exe
PID 836 wrote to memory of 2028	836	qawifxae.exe	im8h3047xu.exe
PID 836 wrote to memory of 2028	836	qawifxae.exe	im8h3047xu.exe
PID 2028 wrote to memory of 900	2028	im8h3047xu.exe	dw20.exe
PID 2028 wrote to memory of 900	2028	im8h3047xu.exe	dw20.exe
PID 2028 wrote to memory of 900	2028	im8h3047xu.exe	dw20.exe
PID 2028 wrote to memory of 900	2028	im8h3047xu.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 TRACKING INFO_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\AWB 9899691012 TRACKING INFO_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\Nla\qawifxae.exe
C:\Users\Admin\AppData\Local\Temp\Nla\qawifxae.exe C:\Users\Admin\AppData\Local\Temp\Nla\gxwnamql.rhv
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\Temp\Nla\im8h3047xu.exe
C:\Users\Admin\AppData\Local\Temp\Nla\qawifxae.exe C:\Users\Admin\AppData\Local\Temp\Nla\gxwnamql.rhv
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 508
4⤵
- Loads dropped DLL
PID:900

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nla\gxwnamql.rhv
MD5
ab2e2f260d519eb9b1cfe7588adfb1e5

SHA1
fcf8e8a29fec7400e8be450e14bf93a3cdadd199

SHA256
5628684c94d776dfc78281619a0358103d79bafced482b31f4f75cac00d7dcdd

SHA512
3c560959b2d0f7673a8cb4617ed0feb689b42f2d546f71d5557fc877a18978365e9e3441b2a0fe3dd91663b4d34d5edc6653a92f7386e647422395f24d418ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\im8h3047xu.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\im8h3047xu.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\npnqjzgd.h
MD5
7ce0c20665f8d8c127efebfb029222d0

SHA1
9d7a445824342e31486ee43a67eb7bcf90016029

SHA256
d47067b52952716b7745c64fc346a836629f18ea1b3e88c6424c4e1284b8f3de

SHA512
47ae5d370c925d7fca6c414c2e32bf828839ac825d93ce1f5f403ae88695d6f5920ee3300e829e6223cf5d8e4bf4320f64176ab0c81d4a91ab0ab0b700d57844

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\qawifxae.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nla\qawifxae.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
\Users\Admin\AppData\Local\Temp\Nla\im8h3047xu.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
\Users\Admin\AppData\Local\Temp\Nla\im8h3047xu.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
\Users\Admin\AppData\Local\Temp\Nla\im8h3047xu.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
\Users\Admin\AppData\Local\Temp\Nla\im8h3047xu.exe
MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
\Users\Admin\AppData\Local\Temp\Nla\qawifxae.exe
MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/836-4-0x0000000000000000-mapping.dmp

Download
memory/836-14-0x0000000000DF0000-0x0000000000DF2000-memory.dmp

Filesize
8KB

Download
memory/900-22-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Filesize
68KB

Download
memory/900-21-0x0000000000000000-mapping.dmp

Download
memory/900-25-0x0000000001DF0000-0x0000000001E01000-memory.dmp

Filesize
68KB

Download
memory/900-28-0x00000000022C0000-0x00000000022D1000-memory.dmp

Filesize
68KB

Download
memory/900-31-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/1648-2-0x0000000074B31000-0x0000000074B33000-memory.dmp

Filesize
8KB

Download
memory/2028-17-0x0000000000991000-0x0000000000992000-memory.dmp

Filesize
4KB

Download
memory/2028-19-0x0000000000997000-0x0000000000998000-memory.dmp

Filesize
4KB

Download
memory/2028-20-0x0000000000998000-0x0000000000999000-memory.dmp

Filesize
4KB

Download
memory/2028-18-0x0000000000992000-0x0000000000994000-memory.dmp

Filesize
8KB

Download
memory/2028-16-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/2028-15-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2028-11-0x000000000040188B-mapping.dmp

Download