agenttesla | 8d9ad4f756e359523361a8481180deb946ab887f6fd5d42c36038b6c81974b9f

General

Target

overdue invoice pdf.exe
Size

646KB
MD5

79cc78ff75cac04dddfa6da6ff4320a3
SHA1

b755efb1b00e46574d024b33d016718b79861656
SHA256

d8ba3d84e3d6655458d8c886913e71fbb9e0b72457e6a091f9055ef78e804820
SHA512

31d18b336710276d390d47ac8d0ff32ea4201fc726e2c2dca001451be5df660222227ee46855619cbb6e498b33f76c242417e393f5e514d9cd94fd87799f2d9b
SSDEEP

12288:kaC0h6EY1raE60bGv6onXttJT2EyaeGMKqoASuZvOMmBVll/:kFS7Zo1ugzJJoAS+/K

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
host2069.hostmonster.com
Port:
587
Username:
[email protected]
Password:
me!@#!@#!@#!@#
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000\Software\Microsoft\Windows\CurrentVersion\Run\qXYojnj = "C:\\Users\\Admin\\AppData\\Roaming\\qXYojnj\\qXYojnj.exe"	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2632 set thread context of 2932	2632	overdue invoice pdf.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2632	overdue invoice pdf.exe
2632	overdue invoice pdf.exe
2632	overdue invoice pdf.exe
2356	powershell.exe
2524	powershell.exe
2632	overdue invoice pdf.exe
2932	RegSvcs.exe
2932	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	overdue invoice pdf.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2932	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2524	2632	overdue invoice pdf.exe	30
PID 2632 wrote to memory of 2524	2632	overdue invoice pdf.exe	30
PID 2632 wrote to memory of 2524	2632	overdue invoice pdf.exe	30
PID 2632 wrote to memory of 2524	2632	overdue invoice pdf.exe	30
PID 2632 wrote to memory of 2356	2632	overdue invoice pdf.exe	32
PID 2632 wrote to memory of 2356	2632	overdue invoice pdf.exe	32
PID 2632 wrote to memory of 2356	2632	overdue invoice pdf.exe	32
PID 2632 wrote to memory of 2356	2632	overdue invoice pdf.exe	32
PID 2632 wrote to memory of 2828	2632	overdue invoice pdf.exe	34
PID 2632 wrote to memory of 2828	2632	overdue invoice pdf.exe	34
PID 2632 wrote to memory of 2828	2632	overdue invoice pdf.exe	34
PID 2632 wrote to memory of 2828	2632	overdue invoice pdf.exe	34
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36
PID 2632 wrote to memory of 2932	2632	overdue invoice pdf.exe	36

C:\Users\Admin\AppData\Local\Temp\overdue invoice pdf.exe
"C:\Users\Admin\AppData\Local\Temp\overdue invoice pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\overdue invoice pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yLVGITAhvNLgO.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yLVGITAhvNLgO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp537D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp537D.tmp

Filesize
1KB

MD5
988a3d13a3bf13b87ad167a953740b02

SHA1
ff415dccde5c697aca9a6710d82cb078bcf61f75

SHA256
25fb827c7d52bd36be4e55948e38826319c7681550532db12d8afaf64c447659

SHA512
bc9cbd4c45eb4afb0ace53fb40b57b954456ff1d15d6b760f9b9517838b33b25f2bc0ac91610308a59dccc64de7a785a5facfe9285f3d69ff1bb20dffe6f7665

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8TUAQ1HYGPL74PAHYOIP.temp

Filesize
7KB

MD5
72b09e81bc84d086b6b45d1d5ef3152b

SHA1
df45f37ceac462cea59ad3213b58a9ca7cee6ec7

SHA256
4007de16606093ea61bc159cc06f75f2df4173afe3de8ca0d74c8503fbf33d47

SHA512
ca3ab1ea3d3139004967652d311be58f0cbfd955ca6b931658549f55aab7a301cb56f796c9f0b5b166ee5ee11db2473313c53dea6ea0abff059abfc8fc80fc0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
72b09e81bc84d086b6b45d1d5ef3152b

SHA1
df45f37ceac462cea59ad3213b58a9ca7cee6ec7

SHA256
4007de16606093ea61bc159cc06f75f2df4173afe3de8ca0d74c8503fbf33d47

SHA512
ca3ab1ea3d3139004967652d311be58f0cbfd955ca6b931658549f55aab7a301cb56f796c9f0b5b166ee5ee11db2473313c53dea6ea0abff059abfc8fc80fc0d

Download Submit
memory/2356-25-0x0000000001C80000-0x0000000001CC0000-memory.dmp

Filesize
256KB

Download
memory/2356-43-0x000000006DEF0000-0x000000006E49B000-memory.dmp

Filesize
5.7MB

Download
memory/2356-26-0x0000000001C80000-0x0000000001CC0000-memory.dmp

Filesize
256KB

Download
memory/2356-23-0x000000006DEF0000-0x000000006E49B000-memory.dmp

Filesize
5.7MB

Download
memory/2356-20-0x000000006DEF0000-0x000000006E49B000-memory.dmp

Filesize
5.7MB

Download
memory/2524-21-0x000000006DEF0000-0x000000006E49B000-memory.dmp

Filesize
5.7MB

Download
memory/2524-42-0x000000006DEF0000-0x000000006E49B000-memory.dmp

Filesize
5.7MB

Download
memory/2524-27-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2524-24-0x000000006DEF0000-0x000000006E49B000-memory.dmp

Filesize
5.7MB

Download
memory/2524-22-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/2632-36-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2632-1-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2632-2-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2632-0-0x00000000002C0000-0x0000000000368000-memory.dmp

Filesize
672KB

Download
memory/2632-4-0x00000000741F0000-0x00000000748DE000-memory.dmp

Filesize
6.9MB

Download
memory/2632-5-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/2632-6-0x0000000000380000-0x000000000038E000-memory.dmp

Filesize
56KB

Download
memory/2632-7-0x0000000005EE0000-0x0000000005F5C000-memory.dmp

Filesize
496KB

Download
memory/2632-3-0x00000000002A0000-0x00000000002B4000-memory.dmp

Filesize
80KB

Download
memory/2932-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2932-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-29-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-37-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-40-0x00000000730D0000-0x00000000737BE000-memory.dmp

Filesize
6.9MB

Download
memory/2932-41-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download
memory/2932-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2932-44-0x00000000730D0000-0x00000000737BE000-memory.dmp

Filesize
6.9MB

Download
memory/2932-45-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads