agenttesla | 3b185f9e2349e436272277d50a22df609a8253d0fafb2c53ea003083b2196689

General

Target
pago de la factura 11-369013.PDF.exe
Size 498KB
Sample230310-meszeacg35
SHA256 3b185f9e2349e436272277d50a22df609a8253d0fafb2c53ea003083b2196689
MD5 649dc8832473cbc0ee81cb42865c54b9
SHA1 89c063f4177c9845f565e82c8e2ed37984d51fa0
SHA512 bf2e66c2549e8115844ebfe837607c5b388166750b4c0761584dde89c32ad2412100c4ef4b7a61baef1913c980acd6cebdc4d49be0271f1ac0b234c059fd4416
SSDEEP 12288:k0UMzHyYogIffWGGjEZJyvWjF6jkS5F3ph:RZSYWwEZJyvWp6533
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.sisoempresarialsas.com
Port
21
Username
[email protected]
Password
.!LV?]FKWxUy

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 2132	4544	pago de la factura 11-369013.PDF.exe	90

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe
4544	pago de la factura 11-369013.PDF.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	pago de la factura 11-369013.PDF.exe
Token: SeDebugPrivilege	2132	jsc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 5076	4544	pago de la factura 11-369013.PDF.exe	84
PID 4544 wrote to memory of 5076	4544	pago de la factura 11-369013.PDF.exe	84
PID 4544 wrote to memory of 2968	4544	pago de la factura 11-369013.PDF.exe	85
PID 4544 wrote to memory of 2968	4544	pago de la factura 11-369013.PDF.exe	85
PID 4544 wrote to memory of 3612	4544	pago de la factura 11-369013.PDF.exe	86
PID 4544 wrote to memory of 3612	4544	pago de la factura 11-369013.PDF.exe	86
PID 4544 wrote to memory of 5044	4544	pago de la factura 11-369013.PDF.exe	87
PID 4544 wrote to memory of 5044	4544	pago de la factura 11-369013.PDF.exe	87
PID 4544 wrote to memory of 3044	4544	pago de la factura 11-369013.PDF.exe	88
PID 4544 wrote to memory of 3044	4544	pago de la factura 11-369013.PDF.exe	88
PID 4544 wrote to memory of 1952	4544	pago de la factura 11-369013.PDF.exe	89
PID 4544 wrote to memory of 1952	4544	pago de la factura 11-369013.PDF.exe	89
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90
PID 4544 wrote to memory of 2132	4544	pago de la factura 11-369013.PDF.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\pago de la factura 11-369013.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\pago de la factura 11-369013.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:5076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:3612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:1952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2132-143-0x0000000005FF0000-0x0000000006082000-memory.dmp

Download

memory/2132-138-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2132-140-0x0000000005540000-0x0000000005AE4000-memory.dmp

Download

memory/2132-141-0x0000000004EB0000-0x0000000004F16000-memory.dmp

Download

memory/2132-142-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Download

memory/2132-144-0x0000000006090000-0x000000000609A000-memory.dmp

Download

memory/2132-145-0x0000000006260000-0x00000000062B0000-memory.dmp

Download

memory/2132-146-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Download

memory/4544-134-0x0000017D754B0000-0x0000017D754C0000-memory.dmp

Download

memory/4544-135-0x0000017D77A30000-0x0000017D77AA6000-memory.dmp

Download

memory/4544-136-0x0000017D779B0000-0x0000017D779CE000-memory.dmp

Download

memory/4544-137-0x0000017D754B0000-0x0000017D754C0000-memory.dmp

Download

memory/4544-133-0x0000017D59E60000-0x0000017D59EE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads