agenttesla | b602dee289b88742659eb780c3f8403cec8cd7d961eec9c25769d3e6848d43bc

General

Target

ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe
Size

49KB
MD5

a29cff9f3e4abba6c30200955f86385a
SHA1

7688abb2c1435457f9169cb2f7244235eeb8fd65
SHA256

b602dee289b88742659eb780c3f8403cec8cd7d961eec9c25769d3e6848d43bc
SHA512

376db263e350a64e7c031b9a592ca5b1ce591e976f837f9bf118273cde02f5df264ae48958beecd837ece101a8321eeaed07f95663133d2155f9f0855351ecd8
SSDEEP

192:6nCMjAVME3Td4754lTP7xrF0YG+MJTNToD4bDlVYNMWfennIWG:ijpE3ad4lTk+MJvbDlV9WfcIW

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.slnorplastlcos.com
Port:
587
Username:
[email protected]
Password:
4Ftwkbc{$1B!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2752	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe
2752	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe
Token: SeDebugPrivilege	2752	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28
PID 2108 wrote to memory of 2752	2108	ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe	28

C:\Users\Admin\AppData\Local\Temp\ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe
"C:\Users\Admin\AppData\Local\Temp\ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe
  "C:\Users\Admin\AppData\Local\Temp\ordine nr. SCH-23-000926 -SCHMACK BIOGAS SRL_pdf .exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2108-0-0x0000000001250000-0x0000000001262000-memory.dmp

Filesize
72KB

Download
memory/2108-1-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-2-0x0000000000680000-0x00000000006C0000-memory.dmp

Filesize
256KB

Download
memory/2108-3-0x0000000004AA0000-0x0000000004AF8000-memory.dmp

Filesize
352KB

Download
memory/2108-4-0x0000000000B80000-0x0000000000BC0000-memory.dmp

Filesize
256KB

Download
memory/2108-5-0x0000000001210000-0x0000000001250000-memory.dmp

Filesize
256KB

Download
memory/2108-6-0x0000000004D40000-0x0000000004D8C000-memory.dmp

Filesize
304KB

Download
memory/2108-7-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2108-8-0x0000000000680000-0x00000000006C0000-memory.dmp

Filesize
256KB

Download
memory/2108-18-0x0000000074C90000-0x000000007537E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-21-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-22-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-23-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2752-24-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-25-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing