agenttesla | 4012c4289aa953f24fdc7e1e257f2d9b04f835a8d6bd1b8eb919271c46a7db62

General

Target

invo5514155.pdf.exe
Size

687KB
MD5

fc0b0215e0ec8169fcd6556e236302c1
SHA1

e7b965067c6b7be5e24ad284562a9bac91e591e3
SHA256

4012c4289aa953f24fdc7e1e257f2d9b04f835a8d6bd1b8eb919271c46a7db62
SHA512

7359ba0dd283d5e9976d2604a87e8a48339e8d2f5433bd2488a2745c6443da672fe9889805b22f6044e2469333ef58b65d37d5f73eae3ab06b76d12704f5c0bd

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.simpleitalian.com.au
Port:
587
Username:
bookings@simpleitalian.com.au
Password:
SIpassword101$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/672-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/672-68-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/672-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1100-62-0x0000000000200000-0x000000000020B000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

invo5514155.pdf.exe

description pid process target process

PID 1100 set thread context of 672 1100 invo5514155.pdf.exe invo5514155.pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

764 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

invo5514155.pdf.exe

pid process

672 invo5514155.pdf.exe
672 invo5514155.pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

invo5514155.pdf.exe

description pid process

Token: SeDebugPrivilege 672 invo5514155.pdf.exe

description	pid	process	target process
PID 1100 set thread context of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe

pid	process
764	schtasks.exe

pid	process
672	invo5514155.pdf.exe
672	invo5514155.pdf.exe

description	pid	process
Token: SeDebugPrivilege	672	invo5514155.pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

invo5514155.pdf.exe

description	pid	process	target process
PID 1100 wrote to memory of 764	1100	invo5514155.pdf.exe	schtasks.exe
PID 1100 wrote to memory of 764	1100	invo5514155.pdf.exe	schtasks.exe
PID 1100 wrote to memory of 764	1100	invo5514155.pdf.exe	schtasks.exe
PID 1100 wrote to memory of 764	1100	invo5514155.pdf.exe	schtasks.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe
PID 1100 wrote to memory of 672	1100	invo5514155.pdf.exe	invo5514155.pdf.exe

C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DsQcdiulZfq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF73A.tmp"
2⤵
- Creates scheduled task(s)
PID:764

C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF73A.tmp
MD5
80b764e27e584d5ecb70a4c45e3ddfc5

SHA1
f183ff2c802a7035dd904cf5111b8d59de93ad34

SHA256
0c4e09cd1c734ddb893987763114edd470198f8b203148ec20a33219d7a5ba49

SHA512
79fd9325107b766b164974a6c6c922c5776dc25eda93ae4e430db67415cafd9a874961af4b9b4ba8815629c89212285fb09c120f8663dc68d009c93957c47737

Download Submit
memory/672-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/672-68-0x00000000004374CE-mapping.dmp

Download
memory/672-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/672-71-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/764-65-0x0000000000000000-mapping.dmp

Download
memory/1100-59-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/1100-61-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/1100-62-0x0000000000200000-0x000000000020B000-memory.dmp

Filesize
44KB

Download
memory/1100-63-0x0000000005BF0000-0x0000000005C73000-memory.dmp

Filesize
524KB

Download
memory/1100-64-0x00000000002C0000-0x00000000002FD000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads