agenttesla | 1e9bf82ba143cb0a8a9d736a716bd01b108f544173d740c96332ef1263c5cecc

General

Target

1221000880.pdf.exe
Size

807KB
MD5

51cc9ef1470b1a132b0c8555bb204291
SHA1

d54e8fb1eef02ec6c1c4d246c912ebfd82bb0e67
SHA256

4618f55b6482e1d13e798ed1045deb42ab9efb04c1e16a2313d62f1ec6d9ef43
SHA512

359b084cb6f27a48793b1554078197786a7d3f6ddf514263c8264cfda9708a4ea80f667f36bfa604c503da98fb44529064b1ce4201bc0c0b1fe6f1f6a09df072

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
cspuri@searchnet.co.in
Password:
22june1969

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3048-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3048-126-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral2/memory/3048-132-0x00000000052C0000-0x00000000057BE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

1221000880.pdf.exe

description pid process target process

PID 644 set thread context of 3048 644 1221000880.pdf.exe 1221000880.pdf.exe

description	pid	process	target process
PID 644 set thread context of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

1221000880.pdf.exe1221000880.pdf.exe

pid	process
644	1221000880.pdf.exe
644	1221000880.pdf.exe
644	1221000880.pdf.exe
644	1221000880.pdf.exe
644	1221000880.pdf.exe
3048	1221000880.pdf.exe
3048	1221000880.pdf.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

1221000880.pdf.exe

pid process

3048 1221000880.pdf.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1221000880.pdf.exe1221000880.pdf.exe

description pid process

Token: SeDebugPrivilege 644 1221000880.pdf.exe
Token: SeDebugPrivilege 3048 1221000880.pdf.exe

pid	process
3048	1221000880.pdf.exe

description	pid	process
Token: SeDebugPrivilege	644	1221000880.pdf.exe
Token: SeDebugPrivilege	3048	1221000880.pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

1221000880.pdf.exe

description	pid	process	target process
PID 644 wrote to memory of 744	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 744	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 744	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe
PID 644 wrote to memory of 3048	644	1221000880.pdf.exe	1221000880.pdf.exe

C:\Users\Admin\AppData\Local\Temp\1221000880.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\1221000880.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644

C:\Users\Admin\AppData\Local\Temp\1221000880.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\1221000880.pdf.exe"
2⤵
PID:744

C:\Users\Admin\AppData\Local\Temp\1221000880.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\1221000880.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3048

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1221000880.pdf.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
memory/644-119-0x0000000004B00000-0x0000000004FFE000-memory.dmp

Filesize
5.0MB

Download
memory/644-124-0x00000000094E0000-0x0000000009522000-memory.dmp

Filesize
264KB

Download
memory/644-118-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/644-114-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/644-120-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/644-121-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/644-117-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/644-123-0x00000000008E0000-0x0000000000953000-memory.dmp

Filesize
460KB

Download
memory/644-122-0x0000000006D70000-0x0000000006D79000-memory.dmp

Filesize
36KB

Download
memory/644-116-0x0000000004A00000-0x0000000004A01000-memory.dmp

Filesize
4KB

Download
memory/3048-126-0x000000000043761E-mapping.dmp

Download
memory/3048-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3048-132-0x00000000052C0000-0x00000000057BE000-memory.dmp

Filesize
5.0MB

Download
memory/3048-133-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/3048-134-0x0000000005FB0000-0x0000000005FB1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads