agenttesla | 6797c9eb17e1ad3b41121bc80db0a97ae642bfca0874c8b7bd391507d2ca5540

General

Target
Aviso de pago.pdf____________________________.exe
Size 54KB
Sample220513-skk4msgge8
SHA256 6797c9eb17e1ad3b41121bc80db0a97ae642bfca0874c8b7bd391507d2ca5540
MD5 05b6b97166b339557424ca035418a640
SHA1 e1699c9c10d6807650fcc35fc76c7744deeb16be
SHA512 0e2c6febd221d1c2e8a465dca46037ab6f826d5780c0ccb7bface146a15d1031124ddd5097b77f275a0714751559a77b8ea4cc4959c37d7ff336c6a3690ee7c8
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.permagraf.com.mx
Port
587
Username
[email protected]
Password
icui4cu2@@
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

resource	yara_rule
behavioral1/memory/572-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/572-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/572-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/572-67-0x0000000000436DAE-mapping.dmp	family_agenttesla
behavioral1/memory/572-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/572-71-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 384 set thread context of 572	384	Aviso de pago.pdf____________________________.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2040	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
384	Aviso de pago.pdf____________________________.exe
384	Aviso de pago.pdf____________________________.exe
384	Aviso de pago.pdf____________________________.exe
572	MSBuild.exe
572	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	Aviso de pago.pdf____________________________.exe
Token: SeDebugPrivilege	572	MSBuild.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1344	384	Aviso de pago.pdf____________________________.exe	28
PID 384 wrote to memory of 1344	384	Aviso de pago.pdf____________________________.exe	28
PID 384 wrote to memory of 1344	384	Aviso de pago.pdf____________________________.exe	28
PID 384 wrote to memory of 1344	384	Aviso de pago.pdf____________________________.exe	28
PID 1344 wrote to memory of 2040	1344	cmd.exe	30
PID 1344 wrote to memory of 2040	1344	cmd.exe	30
PID 1344 wrote to memory of 2040	1344	cmd.exe	30
PID 1344 wrote to memory of 2040	1344	cmd.exe	30
PID 384 wrote to memory of 580	384	Aviso de pago.pdf____________________________.exe	31
PID 384 wrote to memory of 580	384	Aviso de pago.pdf____________________________.exe	31
PID 384 wrote to memory of 580	384	Aviso de pago.pdf____________________________.exe	31
PID 384 wrote to memory of 580	384	Aviso de pago.pdf____________________________.exe	31
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32
PID 384 wrote to memory of 572	384	Aviso de pago.pdf____________________________.exe	32

C:\Users\Admin\AppData\Local\Temp\Aviso de pago.pdf____________________________.exe
"C:\Users\Admin\AppData\Local\Temp\Aviso de pago.pdf____________________________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 15
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\timeout.exe
    timeout 15
    3⤵
    - Delays execution with timeout.exe
    PID:2040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-54-0x00000000012B0000-0x00000000012C2000-memory.dmp

Download

memory/384-55-0x00000000763E1000-0x00000000763E3000-memory.dmp

Download

memory/384-56-0x0000000004D60000-0x0000000004DCC000-memory.dmp

Download

memory/384-57-0x00000000004B0000-0x00000000004F2000-memory.dmp

Download

memory/384-58-0x00000000005B0000-0x00000000005FC000-memory.dmp

Download

memory/572-64-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/572-61-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/572-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/572-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/572-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/572-69-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/572-71-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads