agenttesla | 15b50d5116ba030d793d4fd500c49708f54298d1a7fc5fb5f704713f2ab6b85a

Analysis

max time kernel
132s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
15/08/2023, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

signed PI.pdf.exe
Size

943KB
MD5

af7de1d044c1d002cbdd3540c03a83dd
SHA1

24d17486e7398e7bd2aae69c842ab028f7706b25
SHA256

24f72de47dc358a8ee0f81402576425a5bfc70e54b653484deedab40da7f93a0
SHA512

c477e1426e3ea79f73b2e5a8b8d5b96b07f2f5227fd1ac989b83a674d16a3b4cd111242902faf02cb436760c4fb3bbf6e8e88f1e4a31cb9cec82cf26d6eb4e5e
SSDEEP

24576:QOguuZZiIbW/ecCDLDx0O7Rs6CE3jLMpppdpppppUO9Rs6CE3jLMpppdpppppUO9:4uAZ7W/ecC977Rs6CE3jLbO9Rs6CE3jE

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.steamd.in
Port:
587
Username:
[email protected]
Password:
Purchase321@#
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.ipify.org
40	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4812 set thread context of 3920	4812	signed PI.pdf.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2940	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3920	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2940	4812	signed PI.pdf.exe	91
PID 4812 wrote to memory of 2940	4812	signed PI.pdf.exe	91
PID 4812 wrote to memory of 2940	4812	signed PI.pdf.exe	91
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93
PID 4812 wrote to memory of 3920	4812	signed PI.pdf.exe	93

C:\Users\Admin\AppData\Local\Temp\signed PI.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\signed PI.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WQahNoPyq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6E7F.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6E7F.tmp

Filesize
1KB

MD5
d014c852f6d66b6f9c3722cbc8726837

SHA1
20d88330c6ebff60e14aff01fd4fec5181947dad

SHA256
ceb0941f34f86fe7b38fc0f75d92a99c787dfd54deb9fdb05ace75c81af8e39e

SHA512
ae4c6d025b29b61fdf130b55d8681c807053f8e3fd7cafdc5080dc3fdbbe1ff3f647f5e586275afc8d504da6803c28d8280c2c985678f31a879187d348db5053

Download Submit
memory/3920-151-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/3920-150-0x0000000005810000-0x0000000005820000-memory.dmp

Filesize
64KB

Download
memory/3920-155-0x0000000005810000-0x0000000005820000-memory.dmp

Filesize
64KB

Download
memory/3920-154-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/3920-153-0x0000000007360000-0x0000000007522000-memory.dmp

Filesize
1.8MB

Download
memory/3920-152-0x0000000007140000-0x0000000007190000-memory.dmp

Filesize
320KB

Download
memory/3920-148-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/3920-146-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4812-135-0x00000000054A0000-0x000000000553C000-memory.dmp

Filesize
624KB

Download
memory/4812-141-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4812-137-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/4812-140-0x00000000057F0000-0x0000000005846000-memory.dmp

Filesize
344KB

Download
memory/4812-149-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4812-142-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/4812-133-0x0000000000B60000-0x0000000000C50000-memory.dmp

Filesize
960KB

Download
memory/4812-139-0x0000000005560000-0x000000000556A000-memory.dmp

Filesize
40KB

Download
memory/4812-138-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/4812-134-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4812-136-0x0000000005B10000-0x00000000060B4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads