agenttesla | 023d25a8bafeb122725046d0d8f0bae8d443e2da9452b217965ab9c432be6d52

General

Target

QUOTE2021.PDF.exe
Size

615KB
MD5

424233f0bd0abbf6d559c800a47b5374
SHA1

d253a17418d0a9c26fa0275378d80b0627a28888
SHA256

023d25a8bafeb122725046d0d8f0bae8d443e2da9452b217965ab9c432be6d52
SHA512

ee703ef5c2122dca7a6f390043fe18707a3def7ecb9acb10ba21e53f7cd3bc4915492384f853428c942adc992c86459069d6fb278c7423c745f4ad3c7b3cb3b2

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.vivaldi.net
Port:
587
Username:
Graceboy123@vivaldi.net
Password:
4Lmm4pew4Z3EVCn

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/744-16-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral2/memory/744-15-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTE2021.PDF.exe

description pid process target process

PID 1144 set thread context of 744 1144 QUOTE2021.PDF.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

QUOTE2021.PDF.exeRegSvcs.exe

pid process

1144 QUOTE2021.PDF.exe
1144 QUOTE2021.PDF.exe
1144 QUOTE2021.PDF.exe
744 RegSvcs.exe
744 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

QUOTE2021.PDF.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1144 QUOTE2021.PDF.exe
Token: SeDebugPrivilege 744 RegSvcs.exe

description	pid	process	target process
PID 1144 set thread context of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe

pid	process
1144	QUOTE2021.PDF.exe
1144	QUOTE2021.PDF.exe
1144	QUOTE2021.PDF.exe
744	RegSvcs.exe
744	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1144	QUOTE2021.PDF.exe
Token: SeDebugPrivilege	744	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

QUOTE2021.PDF.exe

description	pid	process	target process
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe
PID 1144 wrote to memory of 744	1144	QUOTE2021.PDF.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\QUOTE2021.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE2021.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-16-0x00000000004374CE-mapping.dmp

Download
memory/744-24-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/744-23-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/744-22-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/744-17-0x0000000073450000-0x0000000073B3E000-memory.dmp

Filesize
6.9MB

Download
memory/744-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1144-7-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/1144-10-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/1144-11-0x000000007EC40000-0x000000007EC41000-memory.dmp

Filesize
4KB

Download
memory/1144-12-0x0000000008300000-0x0000000008304000-memory.dmp

Filesize
16KB

Download
memory/1144-13-0x0000000000BC0000-0x0000000000C2D000-memory.dmp

Filesize
436KB

Download
memory/1144-14-0x0000000006AF0000-0x0000000006B2B000-memory.dmp

Filesize
236KB

Download
memory/1144-9-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/1144-8-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/1144-2-0x0000000073450000-0x0000000073B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1144-6-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/1144-5-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/1144-3-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads