agenttesla | 01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3

Analysis

max time kernel
141s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
Size 671KB
Sample230802-j3valade88
SHA256 01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3
MD5 bd6687dd7ec1ee893b0394316ec2249b
SHA1 a73fd83405530c5905cd675eacf00213250c2477
SHA512 8918ab4cc4089dce89984e14354aaf849450ce497e0b96a43cdbd56dcbd34f4056f60b5c5640ccb310dcac5f24ec0fa6eaf392af2332f411c8301858dc0bb073
SSDEEP 12288:d5MYO0M22fUQbYNrxUtduItO/bqvw7yZiA3mdBLFGrfeY:d6DCwU6YNFUSItYbqvwyKDFt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
JUGCRsm9
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D8C1A8D4-7F6F-461A-B6AB-E00D413482D6}.catalogItem	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
Token: SeDebugPrivilege	3824	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 652	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	95
PID 2808 wrote to memory of 652	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	95
PID 2808 wrote to memory of 652	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	95
PID 2808 wrote to memory of 2596	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	96
PID 2808 wrote to memory of 2596	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	96
PID 2808 wrote to memory of 2596	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	96
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97
PID 2808 wrote to memory of 3824	2808	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	97

C:\Users\Admin\AppData\Local\Temp\57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\57m³ LPG SEMI TRAILER 7 NOS.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:3224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2808-142-0x000000000ABE0000-0x000000000AC7C000-memory.dmp

Download

memory/2808-146-0x0000000074880000-0x0000000075030000-memory.dmp

Download

memory/2808-135-0x0000000006000000-0x00000000065A4000-memory.dmp

Download

memory/2808-136-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Download

memory/2808-137-0x0000000005C90000-0x0000000005CA0000-memory.dmp

Download

memory/2808-138-0x0000000005B10000-0x0000000005B1A000-memory.dmp

Download

memory/2808-139-0x0000000074880000-0x0000000075030000-memory.dmp

Download

memory/2808-140-0x0000000005C90000-0x0000000005CA0000-memory.dmp

Download

memory/2808-134-0x0000000074880000-0x0000000075030000-memory.dmp

Download

memory/2808-133-0x0000000000FC0000-0x000000000106E000-memory.dmp

Download

memory/3824-145-0x0000000074880000-0x0000000075030000-memory.dmp

Download

memory/3824-143-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/3824-147-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download

memory/3824-148-0x0000000005190000-0x00000000051F6000-memory.dmp

Download

memory/3824-149-0x00000000063F0000-0x0000000006440000-memory.dmp

Download

memory/3824-150-0x0000000006710000-0x00000000068D2000-memory.dmp

Download

memory/3824-151-0x0000000074880000-0x0000000075030000-memory.dmp

Download

memory/3824-152-0x00000000050D0000-0x00000000050E0000-memory.dmp

Download