agenttesla | 41fc81a9ebcb9f6405555db22b71ca764939d1dbcf113e446418e3cb6d394184

General

Target

Over-due invoice_pdf.exe
Size

26KB
MD5

a6b0c18fb26a8c6eed21a2ceadb3bcb6
SHA1

8b419602ffe57720dde8617b9061f6876c8835a1
SHA256

41fc81a9ebcb9f6405555db22b71ca764939d1dbcf113e446418e3cb6d394184
SHA512

ed0bdfe0a0053ac02b40952af9a4bd63f5d3b5a5684e3a0c26d6f77c83c5d365f7a9b2e8ca3fe69e11c6dd84f51f3e0961ccdffcf62ed27e95915d8c63834f2e

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.tpcdel.com
Port:
587
Username:
[email protected]
Password:
EmlP@2018

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tpcdel.com
Port:
587
Username:
[email protected]
Password:
EmlP@2018

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4280-10-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral2/memory/4280-11-0x000000000044A95E-mapping.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Over-due invoice_pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZozjABYW = "C:\\Users\\Admin\\AppData\\Roaming\\wPLpKMo\\UGxXf.exe"	Over-due invoice_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Over-due invoice_pdf.exe

description pid process target process

PID 4800 set thread context of 4280 4800 Over-due invoice_pdf.exe Over-due invoice_pdf.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Over-due invoice_pdf.exe

pid process

4280 Over-due invoice_pdf.exe
4280 Over-due invoice_pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Over-due invoice_pdf.exeOver-due invoice_pdf.exe

description pid process

Token: SeDebugPrivilege 4800 Over-due invoice_pdf.exe
Token: SeDebugPrivilege 4280 Over-due invoice_pdf.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Over-due invoice_pdf.exe

pid process

4280 Over-due invoice_pdf.exe

description	pid	process	target process
PID 4800 set thread context of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe

pid	process
4280	Over-due invoice_pdf.exe
4280	Over-due invoice_pdf.exe

description	pid	process
Token: SeDebugPrivilege	4800	Over-due invoice_pdf.exe
Token: SeDebugPrivilege	4280	Over-due invoice_pdf.exe

pid	process
4280	Over-due invoice_pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Over-due invoice_pdf.exe

description	pid	process	target process
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe
PID 4800 wrote to memory of 4280	4800	Over-due invoice_pdf.exe	Over-due invoice_pdf.exe

C:\Users\Admin\AppData\Local\Temp\Over-due invoice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Over-due invoice_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800

C:\Users\Admin\AppData\Local\Temp\Over-due invoice_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Over-due invoice_pdf.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4280-18-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/4280-17-0x00000000057F0000-0x00000000057F1000-memory.dmp

Filesize
4KB

Download
memory/4280-10-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4280-22-0x0000000001921000-0x0000000001922000-memory.dmp

Filesize
4KB

Download
memory/4280-11-0x000000000044A95E-mapping.dmp

Download
memory/4280-21-0x0000000006830000-0x0000000006831000-memory.dmp

Filesize
4KB

Download
memory/4280-20-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

Filesize
4KB

Download
memory/4280-12-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/4280-19-0x0000000001920000-0x0000000001921000-memory.dmp

Filesize
4KB

Download
memory/4800-7-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

Filesize
4KB

Download
memory/4800-9-0x0000000006340000-0x0000000006341000-memory.dmp

Filesize
4KB

Download
memory/4800-6-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/4800-2-0x00000000739D0000-0x00000000740BE000-memory.dmp

Filesize
6.9MB

Download
memory/4800-4-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/4800-8-0x0000000005C10000-0x0000000005C61000-memory.dmp

Filesize
324KB

Download
memory/4800-3-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/4800-5-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads