agenttesla | 4012c4289aa953f24fdc7e1e257f2d9b04f835a8d6bd1b8eb919271c46a7db62

General

Target

invo5514155.pdf.gz.exe
Size

687KB
MD5

fc0b0215e0ec8169fcd6556e236302c1
SHA1

e7b965067c6b7be5e24ad284562a9bac91e591e3
SHA256

4012c4289aa953f24fdc7e1e257f2d9b04f835a8d6bd1b8eb919271c46a7db62
SHA512

7359ba0dd283d5e9976d2604a87e8a48339e8d2f5433bd2488a2745c6443da672fe9889805b22f6044e2469333ef58b65d37d5f73eae3ab06b76d12704f5c0bd

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.simpleitalian.com.au
Port:
587
Username:
bookings@simpleitalian.com.au
Password:
SIpassword101$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/360-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/360-69-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/360-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1072-63-0x0000000000290000-0x000000000029B000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

invo5514155.pdf.gz.exe

description pid process target process

PID 1072 set thread context of 360 1072 invo5514155.pdf.gz.exe invo5514155.pdf.gz.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1016 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

invo5514155.pdf.gz.exeinvo5514155.pdf.gz.exe

pid process

1072 invo5514155.pdf.gz.exe
360 invo5514155.pdf.gz.exe
360 invo5514155.pdf.gz.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

invo5514155.pdf.gz.exeinvo5514155.pdf.gz.exe

description pid process

Token: SeDebugPrivilege 1072 invo5514155.pdf.gz.exe
Token: SeDebugPrivilege 360 invo5514155.pdf.gz.exe

description	pid	process	target process
PID 1072 set thread context of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe

pid	process
1016	schtasks.exe

pid	process
1072	invo5514155.pdf.gz.exe
360	invo5514155.pdf.gz.exe
360	invo5514155.pdf.gz.exe

description	pid	process
Token: SeDebugPrivilege	1072	invo5514155.pdf.gz.exe
Token: SeDebugPrivilege	360	invo5514155.pdf.gz.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

invo5514155.pdf.gz.exe

description	pid	process	target process
PID 1072 wrote to memory of 1016	1072	invo5514155.pdf.gz.exe	schtasks.exe
PID 1072 wrote to memory of 1016	1072	invo5514155.pdf.gz.exe	schtasks.exe
PID 1072 wrote to memory of 1016	1072	invo5514155.pdf.gz.exe	schtasks.exe
PID 1072 wrote to memory of 1016	1072	invo5514155.pdf.gz.exe	schtasks.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe
PID 1072 wrote to memory of 360	1072	invo5514155.pdf.gz.exe	invo5514155.pdf.gz.exe

C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.gz.exe
"C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.gz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DsQcdiulZfq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF91E.tmp"
2⤵
- Creates scheduled task(s)
PID:1016

C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.gz.exe
"C:\Users\Admin\AppData\Local\Temp\invo5514155.pdf.gz.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:360

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF91E.tmp
MD5
0f27fb31f0fdbc76cd816454e982c257

SHA1
3fc6750a109da9a3b7834f9be6ee3df692b0eb3d

SHA256
e47f48763aa04239f4ef42a2ba52bc5e174ced77a6ecdb45cd987bad0cc376ef

SHA512
59e2d36638589919d846126e3fef375622d87335d545028de9aba927e27049bfa9b8c0bd547f9a9262e175b902ca282784acd3142d6df3898d6c5a401d99ea39

Download Submit
memory/360-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/360-69-0x00000000004374CE-mapping.dmp

Download
memory/360-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/360-72-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Filesize
4KB

Download
memory/1016-66-0x0000000000000000-mapping.dmp

Download
memory/1072-60-0x0000000000C50000-0x0000000000C51000-memory.dmp

Filesize
4KB

Download
memory/1072-62-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/1072-63-0x0000000000290000-0x000000000029B000-memory.dmp

Filesize
44KB

Download
memory/1072-64-0x0000000005170000-0x00000000051F3000-memory.dmp

Filesize
524KB

Download
memory/1072-65-0x00000000007B0000-0x00000000007ED000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads