agenttesla | de0b80f33037ee2253015508b278b103356b4ca38df599ecb1c91fa1403211c2

General

Target

Request for Quotation-4505527156.pdf.exe
Size

808KB
MD5

53ee1719315e25f5a485e032b7596c89
SHA1

ba28ef98dc4e74277c0fe370a7dd21e655b1abd4
SHA256

de0b80f33037ee2253015508b278b103356b4ca38df599ecb1c91fa1403211c2
SHA512

3f0b0ecb915e8d5ab4aec38049d00e5368d1d256110d4a8544444bec3db402ea02897111aefaa517d427de5ebf971b5bd7e38f1b2ea622d53552d3d3ee2818ce

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.saudimedlabexpo.com
Port:
587
Username:
info@saudimedlabexpo.com
Password:
]dTqP-]^T]Pt

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3244-139-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3244-140-0x00000000004375BE-mapping.dmp	family_agenttesla
behavioral2/memory/3244-152-0x00000000056B0000-0x0000000005BAE000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Request for Quotation-4505527156.pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\pGKuRU = "C:\\Users\\Admin\\AppData\\Roaming\\pGKuRU\\pGKuRU.exe"	Request for Quotation-4505527156.pdf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Request for Quotation-4505527156.pdf.exe

description	pid	process	target process
PID 740 set thread context of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1652 schtasks.exe

pid	process
1652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

Request for Quotation-4505527156.pdf.exeRequest for Quotation-4505527156.pdf.exepowershell.exepowershell.exepowershell.exe

pid	process
740	Request for Quotation-4505527156.pdf.exe
3244	Request for Quotation-4505527156.pdf.exe
3244	Request for Quotation-4505527156.pdf.exe
8	powershell.exe
3592	powershell.exe
1832	powershell.exe
8	powershell.exe
3592	powershell.exe
1832	powershell.exe
3592	powershell.exe
8	powershell.exe
1832	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Request for Quotation-4505527156.pdf.exeRequest for Quotation-4505527156.pdf.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	740	Request for Quotation-4505527156.pdf.exe
Token: SeDebugPrivilege	3244	Request for Quotation-4505527156.pdf.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

Request for Quotation-4505527156.pdf.exe

description	pid	process	target process
PID 740 wrote to memory of 8	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 8	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 8	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 3592	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 3592	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 3592	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 1652	740	Request for Quotation-4505527156.pdf.exe	schtasks.exe
PID 740 wrote to memory of 1652	740	Request for Quotation-4505527156.pdf.exe	schtasks.exe
PID 740 wrote to memory of 1652	740	Request for Quotation-4505527156.pdf.exe	schtasks.exe
PID 740 wrote to memory of 1832	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 1832	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 1832	740	Request for Quotation-4505527156.pdf.exe	powershell.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe
PID 740 wrote to memory of 3244	740	Request for Quotation-4505527156.pdf.exe	Request for Quotation-4505527156.pdf.exe

C:\Users\Admin\AppData\Local\Temp\Request for Quotation-4505527156.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Request for Quotation-4505527156.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Request for Quotation-4505527156.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aUcLiD.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aUcLiD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1CDB.tmp"
2⤵
- Creates scheduled task(s)
PID:1652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aUcLiD.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Users\Admin\AppData\Local\Temp\Request for Quotation-4505527156.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Request for Quotation-4505527156.pdf.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
120e7de165e66b25aeb8e56f6e4489f6

SHA1
5ac2e13e03a96fad403d6ae9e8e677aa56ca9b7e

SHA256
561458a715cd7a827c27c2891997e97a20e9ed72d971f278e84339d1a985924c

SHA512
5e9bab6807efe87a01968bb89d59870ef1756a706e0bd989bf2aa506d2cd367c9aba8f29699d5abe6c93e9bd647c7fefc8bf2cf06a69ae9c3a4862c5655b4d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1CDB.tmp
MD5
bd1dcf7b9e9c1b40f917ef7d875f131c

SHA1
26e339613e4ff0c3fd81ecd58a865936d6a8a566

SHA256
879fb30c708b590a962494dbdbef0dca375b93beabcdc3325c19c374c7047204

SHA512
437523f729404f51ed63fea3fd6079644a89332bcf053c9c3f44d2276fd775566e25192c5a86667f23429a207dcb4d40f1422d9c59b1e90b8bb0352a2fcbf5e9

Download Submit
memory/8-149-0x0000000004132000-0x0000000004133000-memory.dmp

Filesize
4KB

Download
memory/8-129-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/8-195-0x0000000004133000-0x0000000004134000-memory.dmp

Filesize
4KB

Download
memory/8-194-0x000000007E980000-0x000000007E981000-memory.dmp

Filesize
4KB

Download
memory/8-167-0x0000000007880000-0x0000000007881000-memory.dmp

Filesize
4KB

Download
memory/8-164-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download
memory/8-125-0x0000000000000000-mapping.dmp

Download
memory/8-130-0x0000000006520000-0x0000000006521000-memory.dmp

Filesize
4KB

Download
memory/8-135-0x0000000006B90000-0x0000000006B91000-memory.dmp

Filesize
4KB

Download
memory/740-117-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/740-124-0x0000000008E60000-0x0000000008EF7000-memory.dmp

Filesize
604KB

Download
memory/740-121-0x0000000005510000-0x0000000005A0E000-memory.dmp

Filesize
5.0MB

Download
memory/740-119-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/740-123-0x00000000013A0000-0x0000000001465000-memory.dmp

Filesize
788KB

Download
memory/740-122-0x0000000005830000-0x0000000005834000-memory.dmp

Filesize
16KB

Download
memory/740-118-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/740-114-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/740-116-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/740-120-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/1652-131-0x0000000000000000-mapping.dmp

Download
memory/1832-153-0x0000000006910000-0x0000000006911000-memory.dmp

Filesize
4KB

Download
memory/1832-154-0x0000000006912000-0x0000000006913000-memory.dmp

Filesize
4KB

Download
memory/1832-155-0x00000000075B0000-0x00000000075B1000-memory.dmp

Filesize
4KB

Download
memory/1832-158-0x0000000007760000-0x0000000007761000-memory.dmp

Filesize
4KB

Download
memory/1832-138-0x0000000000000000-mapping.dmp

Download
memory/1832-173-0x0000000008030000-0x0000000008031000-memory.dmp

Filesize
4KB

Download
memory/1832-197-0x0000000006913000-0x0000000006914000-memory.dmp

Filesize
4KB

Download
memory/1832-193-0x000000007F7E0000-0x000000007F7E1000-memory.dmp

Filesize
4KB

Download
memory/3244-140-0x00000000004375BE-mapping.dmp

Download
memory/3244-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3244-152-0x00000000056B0000-0x0000000005BAE000-memory.dmp

Filesize
5.0MB

Download
memory/3592-150-0x0000000006720000-0x0000000006721000-memory.dmp

Filesize
4KB

Download
memory/3592-196-0x0000000006723000-0x0000000006724000-memory.dmp

Filesize
4KB

Download
memory/3592-192-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/3592-170-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/3592-161-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download
memory/3592-151-0x0000000006722000-0x0000000006723000-memory.dmp

Filesize
4KB

Download
memory/3592-128-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads