agenttesla | 56757accfe00022eadd58f3f82ff5b4de4d2aa6e3fe427fa990af3d31723ebd9

General

Target

RFQ# ZAT77095_pdf.scr
Size

1001KB
MD5

a68e022018d05e68ab3cfa488af1c998
SHA1

c826625d790173e42ad53ca5e33879c35069996b
SHA256

56757accfe00022eadd58f3f82ff5b4de4d2aa6e3fe427fa990af3d31723ebd9
SHA512

64739d5a31d7b3b4870005d84d157ac5b19d31647771e072e75e7d28ddc3259e5d00fd3cf8b7bcfe8c564d9ce96c4a4fdcc1509e9455ff7d900371565795719a

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
emmanuel.chiboy@yandex.ru
Password:
emmanuel123456789

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3928-17-0x000000000E420000-0x000000000E456000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RFQ# ZAT77095_pdf.scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\gvADUyGs = "C:\\Users\\Admin\\AppData\\Roaming\\gvADUyGs\\gvADUyGs.exe"	RFQ# ZAT77095_pdf.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2300 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

RFQ# ZAT77095_pdf.scr

pid process

3928 RFQ# ZAT77095_pdf.scr
3928 RFQ# ZAT77095_pdf.scr
3928 RFQ# ZAT77095_pdf.scr
3928 RFQ# ZAT77095_pdf.scr
3928 RFQ# ZAT77095_pdf.scr
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ# ZAT77095_pdf.scr

description pid process

Token: SeDebugPrivilege 3928 RFQ# ZAT77095_pdf.scr

pid	process
2300	schtasks.exe

pid	process
3928	RFQ# ZAT77095_pdf.scr
3928	RFQ# ZAT77095_pdf.scr
3928	RFQ# ZAT77095_pdf.scr
3928	RFQ# ZAT77095_pdf.scr
3928	RFQ# ZAT77095_pdf.scr

description	pid	process
Token: SeDebugPrivilege	3928	RFQ# ZAT77095_pdf.scr

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

RFQ# ZAT77095_pdf.scr

description	pid	process	target process
PID 3928 wrote to memory of 2300	3928	RFQ# ZAT77095_pdf.scr	schtasks.exe
PID 3928 wrote to memory of 2300	3928	RFQ# ZAT77095_pdf.scr	schtasks.exe
PID 3928 wrote to memory of 2300	3928	RFQ# ZAT77095_pdf.scr	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\RFQ# ZAT77095_pdf.scr
"C:\Users\Admin\AppData\Local\Temp\RFQ# ZAT77095_pdf.scr" /S
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sVXGXpIc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD9D6.tmp"
2⤵
- Creates scheduled task(s)
PID:2300

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD9D6.tmp
MD5
4cc992708209000b7ded0d9bc1870c7b

SHA1
eeafdb3557f36d4cd71288d094cb47bb544ec5ee

SHA256
c1d3f36a562bfbe318fd738b2b8a4cf7a11b1ec2e04b1013d6c84229fba3f92d

SHA512
88b3d5fff9c0e7b6bc55712e4d0e0ba58bc68dc4ba82f879ffafc8ce371cc152b9f1fbf041ff5ea3ea4cf40106b066bc08256b42f41169a95075e0c52a321f62

Download Submit
memory/2300-15-0x0000000000000000-mapping.dmp

Download
memory/3928-7-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/3928-12-0x0000000008100000-0x0000000008104000-memory.dmp

Filesize
16KB

Download
memory/3928-2-0x0000000073BA0000-0x000000007428E000-memory.dmp

Filesize
6.9MB

Download
memory/3928-8-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3928-9-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3928-10-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/3928-11-0x000000007EAE0000-0x000000007EAE1000-memory.dmp

Filesize
4KB

Download
memory/3928-6-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3928-13-0x0000000000A50000-0x0000000000AC3000-memory.dmp

Filesize
460KB

Download
memory/3928-14-0x0000000006700000-0x000000000673B000-memory.dmp

Filesize
236KB

Download
memory/3928-5-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/3928-3-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/3928-17-0x000000000E420000-0x000000000E456000-memory.dmp

Filesize
216KB

Download
memory/3928-18-0x000000000E490000-0x000000000E491000-memory.dmp

Filesize
4KB

Download
memory/3928-19-0x000000000E530000-0x000000000E531000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads