agenttesla | 300b58c2becddba9d514fbd569da74a47295518e3e9872035142f5ad9e99923e

General

Target

INQUIRY_pdf__.exe
Size

525KB
MD5

15e91b66fb88390b9833cf3a79cab0ca
SHA1

e370b599b7e53bf35890e2e2f7e7b1a7e978ce86
SHA256

da7f00e9042a254deafda735ffb54a8c03b4d3af45bc297d1dd412f7840cb77f
SHA512

d5e5e63c7897506d80608ffff0571897b899d3964e19c51f8762412d04201a67b72a179bc11e6afb3c940a241dd42505ea9e074a947055b27aa6a4bd3704553e

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.jpmvt.com
Port:
587
Username:
[email protected]
Password:
P@ssw0rd

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1196-61-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1196-62-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1196-63-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1196-64-0x0000000000446EAE-mapping.dmp	family_agenttesla
behavioral1/memory/1196-66-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1196-68-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

INQUIRY_pdf__.exe

description pid process target process

PID 1672 set thread context of 1196 1672 INQUIRY_pdf__.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1828 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1196 RegSvcs.exe
1196 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1196 RegSvcs.exe

description	pid	process	target process
PID 1672 set thread context of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe

pid	process
1828	schtasks.exe

pid	process
1196	RegSvcs.exe
1196	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1196	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

INQUIRY_pdf__.exe

description	pid	process	target process
PID 1672 wrote to memory of 1828	1672	INQUIRY_pdf__.exe	schtasks.exe
PID 1672 wrote to memory of 1828	1672	INQUIRY_pdf__.exe	schtasks.exe
PID 1672 wrote to memory of 1828	1672	INQUIRY_pdf__.exe	schtasks.exe
PID 1672 wrote to memory of 1828	1672	INQUIRY_pdf__.exe	schtasks.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe
PID 1672 wrote to memory of 1196	1672	INQUIRY_pdf__.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\INQUIRY_pdf__.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY_pdf__.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YBuNhmDhcB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC03.tmp"
2⤵
- Creates scheduled task(s)
PID:1828

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC03.tmp
Filesize
1KB

MD5
12b4df3587f0e48f2c384eb03e2e2c3c

SHA1
06253625d7315a6412eacd82eecbebb4e8a7cf0e

SHA256
d1240365b2134074d05535c50aded0e92fea453cf1764cdbc698ff8a77471b98

SHA512
fd8047dd1b979d3b93e2eab6bc0328b5b801900b201c87f653e2616bab7bcb81bd0623bf243a40866210fdfa0d37af518264a920c83c64fddf0539e68931a55c

Download Submit
memory/1196-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1196-58-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1196-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1196-62-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1196-63-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1196-64-0x0000000000446EAE-mapping.dmp

Download
memory/1196-66-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1196-68-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1196-70-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-55-0x0000000074460000-0x0000000074A0B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1828-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads