agenttesla | e01b10b57d317655cde32a37805d387131b27c88557241e0cee953e2419af93a

General

Target

PO-16032021,PDF.exe
Size

1.1MB
MD5

d7e49ef3a90bdeb44d7b5bb85bebbc1b
SHA1

52404f0c92b94bf6ce07905592dcf614013bf08c
SHA256

e01b10b57d317655cde32a37805d387131b27c88557241e0cee953e2419af93a
SHA512

53d8decdcec050da5adca3b16becaffc8bc1955640c55570a98a66e1913d50f1e36d9c0b49231386a0ed04439004b18b0b9b66f1b6c4d101a9c6e767fc8ccf89

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.biolegends.net
Port:
587
Username:
intlcs@biolegends.net
Password:
dFKf#W)7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3548-138-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3548-139-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral2/memory/3548-159-0x0000000005740000-0x0000000005C3E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

PO-16032021,PDF.exe

description pid process target process

PID 4060 set thread context of 3548 4060 PO-16032021,PDF.exe PO-16032021,PDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1176 schtasks.exe

description	pid	process	target process
PID 4060 set thread context of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe

pid	process
1176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

PO-16032021,PDF.exePO-16032021,PDF.exepowershell.exepowershell.exepowershell.exe

pid	process
4060	PO-16032021,PDF.exe
4060	PO-16032021,PDF.exe
4060	PO-16032021,PDF.exe
4060	PO-16032021,PDF.exe
4060	PO-16032021,PDF.exe
4060	PO-16032021,PDF.exe
3548	PO-16032021,PDF.exe
3548	PO-16032021,PDF.exe
4036	powershell.exe
2044	powershell.exe
3076	powershell.exe
3076	powershell.exe
2044	powershell.exe
4036	powershell.exe
2044	powershell.exe
3076	powershell.exe
4036	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

PO-16032021,PDF.exePO-16032021,PDF.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4060	PO-16032021,PDF.exe
Token: SeDebugPrivilege	3548	PO-16032021,PDF.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	4036	powershell.exe
Token: SeDebugPrivilege	3076	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

PO-16032021,PDF.exe

description	pid	process	target process
PID 4060 wrote to memory of 4036	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 4036	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 4036	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 2044	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 2044	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 2044	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 1176	4060	PO-16032021,PDF.exe	schtasks.exe
PID 4060 wrote to memory of 1176	4060	PO-16032021,PDF.exe	schtasks.exe
PID 4060 wrote to memory of 1176	4060	PO-16032021,PDF.exe	schtasks.exe
PID 4060 wrote to memory of 3076	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 3076	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 3076	4060	PO-16032021,PDF.exe	powershell.exe
PID 4060 wrote to memory of 1748	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 1748	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 1748	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe
PID 4060 wrote to memory of 3548	4060	PO-16032021,PDF.exe	PO-16032021,PDF.exe

C:\Users\Admin\AppData\Local\Temp\PO-16032021,PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PO-16032021,PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-16032021,PDF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yVXfXys.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yVXfXys" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA1AF.tmp"
2⤵
- Creates scheduled task(s)
PID:1176

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yVXfXys.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Users\Admin\AppData\Local\Temp\PO-16032021,PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PO-16032021,PDF.exe"
2⤵
PID:1748

C:\Users\Admin\AppData\Local\Temp\PO-16032021,PDF.exe
"C:\Users\Admin\AppData\Local\Temp\PO-16032021,PDF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO-16032021,PDF.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
6090ebef62f4ca0556c5d9f671d35ef8

SHA1
2d50113c62cfea2194b2a272a985bb51efe71b23

SHA256
294881200132b51cbbbde120b02cd1c2fe476649b8e0ed7ef89eea2144e6b146

SHA512
b62ffdab3c0d226d84f4bd532a007e44819619f8c2de3eb56181ac60fca79881ab69cbfd10e21860bda3ebd4583744d872e81a2dba81e175087da5c36e0389c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA1AF.tmp
MD5
2a7c4aaa09b82be73895530bd9d35405

SHA1
b642de062cc33f64042eb9c1f57bc3d3265db7de

SHA256
8347d634c93b564a6dd67a4d86870f4b2dfdfd8922f72f7a8c08a603a10048a8

SHA512
47d67d96f0abee411f0f1b4bb1e86e029a4908d82bcbd3e50633ad1e74cdd6fa64ac83183a66e2c4b23afbf4f550ab4f93072dfe68a0283a99dad21a00e32318

Download Submit
memory/1176-127-0x0000000000000000-mapping.dmp

Download
memory/2044-193-0x000000007F670000-0x000000007F671000-memory.dmp

Filesize
4KB

Download
memory/2044-150-0x0000000007010000-0x0000000007011000-memory.dmp

Filesize
4KB

Download
memory/2044-174-0x00000000082B0000-0x00000000082B1000-memory.dmp

Filesize
4KB

Download
memory/2044-171-0x00000000084D0000-0x00000000084D1000-memory.dmp

Filesize
4KB

Download
memory/2044-168-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

Filesize
4KB

Download
memory/2044-160-0x0000000007AC0000-0x0000000007AC1000-memory.dmp

Filesize
4KB

Download
memory/2044-126-0x0000000000000000-mapping.dmp

Download
memory/2044-156-0x0000000007220000-0x0000000007221000-memory.dmp

Filesize
4KB

Download
memory/2044-133-0x00000000047B0000-0x00000000047B1000-memory.dmp

Filesize
4KB

Download
memory/2044-134-0x0000000007490000-0x0000000007491000-memory.dmp

Filesize
4KB

Download
memory/2044-154-0x0000000006E52000-0x0000000006E53000-memory.dmp

Filesize
4KB

Download
memory/2044-151-0x0000000006E50000-0x0000000006E51000-memory.dmp

Filesize
4KB

Download
memory/2044-152-0x00000000071B0000-0x00000000071B1000-memory.dmp

Filesize
4KB

Download
memory/2044-198-0x0000000006E53000-0x0000000006E54000-memory.dmp

Filesize
4KB

Download
memory/3076-162-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/3076-137-0x0000000000000000-mapping.dmp

Download
memory/3076-197-0x0000000006B33000-0x0000000006B34000-memory.dmp

Filesize
4KB

Download
memory/3076-194-0x000000007E880000-0x000000007E881000-memory.dmp

Filesize
4KB

Download
memory/3076-163-0x0000000006B32000-0x0000000006B33000-memory.dmp

Filesize
4KB

Download
memory/3548-139-0x00000000004375EE-mapping.dmp

Download
memory/3548-159-0x0000000005740000-0x0000000005C3E000-memory.dmp

Filesize
5.0MB

Download
memory/3548-138-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4036-125-0x0000000000000000-mapping.dmp

Download
memory/4036-195-0x000000007FBE0000-0x000000007FBE1000-memory.dmp

Filesize
4KB

Download
memory/4036-149-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/4036-196-0x0000000004F23000-0x0000000004F24000-memory.dmp

Filesize
4KB

Download
memory/4036-157-0x0000000004F22000-0x0000000004F23000-memory.dmp

Filesize
4KB

Download
memory/4060-124-0x0000000007EE0000-0x0000000007F1C000-memory.dmp

Filesize
240KB

Download
memory/4060-122-0x0000000004D10000-0x0000000004D19000-memory.dmp

Filesize
36KB

Download
memory/4060-121-0x0000000004C80000-0x000000000517E000-memory.dmp

Filesize
5.0MB

Download
memory/4060-123-0x0000000000D10000-0x0000000000D89000-memory.dmp

Filesize
484KB

Download
memory/4060-120-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/4060-114-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/4060-119-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/4060-118-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/4060-117-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/4060-116-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads