agenttesla | a59fd17f9d10de072c5ebef7f57a040d0f2dfd5d66c0640020be80f204d48588

General

Target
PO - 476762202 & 476762182_JULY 2022.Pdf.exe
Size 943KB
Sample220711-mfyahsafa7
SHA256 a59fd17f9d10de072c5ebef7f57a040d0f2dfd5d66c0640020be80f204d48588
MD5 78bdf1f4de1569d85ee57088001bc712
SHA1 49ffbdf46aa6c6516e7ac45a7661d97699e9e1c4
SHA512 05792706e300e33fadbbaf67711c5b954ec87777d131f212a69d81e1d2ef6755ce41c1aae503c160ca73e4395493feb58bc4a871c9c2070b241e048d2b3c51f5
MD5 SHA1 SHA512

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.obynnehhhan.com
Port
587
Username
[email protected]
Password
G$MUuYG3

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/1972-138-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe
1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe
1972	MSBuild.exe
1972	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe
Token: SeDebugPrivilege	1972	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 3536	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	92
PID 1636 wrote to memory of 3536	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	92
PID 1636 wrote to memory of 3536	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	92
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93
PID 1636 wrote to memory of 1972	1636	PO - 476762202 & 476762182_JULY 2022.Pdf.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\PO - 476762202 & 476762182_JULY 2022.Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO - 476762202 & 476762182_JULY 2022.Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-130-0x0000000000D60000-0x0000000000E50000-memory.dmp

Download

memory/1636-131-0x0000000005CC0000-0x0000000006264000-memory.dmp

Download

memory/1636-132-0x0000000005710000-0x00000000057A2000-memory.dmp

Download

memory/1636-133-0x0000000005680000-0x000000000568A000-memory.dmp

Download

memory/1636-134-0x0000000007DE0000-0x0000000007E7C000-memory.dmp

Download

memory/1636-135-0x00000000084D0000-0x0000000008536000-memory.dmp

Download

memory/1972-138-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1972-139-0x0000000001830000-0x0000000001880000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads