agenttesla | 3aacc79d8cd0a0faabf7a4f523422c1afc768555244896be14ef322327cfbfb5

General

Target

Amendment POs 05-Dec 2023 pdf.exe
Size

423KB
MD5

db004427de4f603941d2f40d6a22d105
SHA1

83879efd1dab6923cc56a979756c0e0cff3d4320
SHA256

49c8753d20ef77ddfd436992e8c015dd23cc0a5e03429f614470321602df624e
SHA512

d8a11bcb010f5a1476b05b7fe422d51e24fe2cbbbc6098ea4110fd0733cba8a99ccf7ac079fbc9484a550af5a9c183b693ae9e3e90ad10474fff2f82031d064d
SSDEEP

6144:T8LxB8/leyb8dfEPuc+W5nSPWO2vR72Tl7CjfsLkt1QSdUqZEIWjbFYh7zQcjzRF:x/leyEfEE4yqScUqZE/jbFYfznxlnksb

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

efodnd.exeefodnd.exe

pid process

3004 efodnd.exe
1308 efodnd.exe
Loads dropped DLL 2 IoCs

Processes:

Amendment POs 05-Dec 2023 pdf.exeefodnd.exe

pid process

2936 Amendment POs 05-Dec 2023 pdf.exe
3004 efodnd.exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3004	efodnd.exe
1308	efodnd.exe

pid	process
2936	Amendment POs 05-Dec 2023 pdf.exe
3004	efodnd.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

efodnd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	efodnd.exe
Key opened	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	efodnd.exe
Key opened	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	efodnd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

efodnd.exe

description pid process target process

PID 3004 set thread context of 1308 3004 efodnd.exe efodnd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

efodnd.exe

pid process

1308 efodnd.exe
1308 efodnd.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

efodnd.exe

pid process

3004 efodnd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

efodnd.exe

description pid process

Token: SeDebugPrivilege 1308 efodnd.exe

description	pid	process	target process
PID 3004 set thread context of 1308	3004	efodnd.exe	efodnd.exe

pid	process
1308	efodnd.exe
1308	efodnd.exe

pid	process
3004	efodnd.exe

description	pid	process
Token: SeDebugPrivilege	1308	efodnd.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Amendment POs 05-Dec 2023 pdf.exeefodnd.exe

description	pid	process	target process
PID 2936 wrote to memory of 3004	2936	Amendment POs 05-Dec 2023 pdf.exe	efodnd.exe
PID 2936 wrote to memory of 3004	2936	Amendment POs 05-Dec 2023 pdf.exe	efodnd.exe
PID 2936 wrote to memory of 3004	2936	Amendment POs 05-Dec 2023 pdf.exe	efodnd.exe
PID 2936 wrote to memory of 3004	2936	Amendment POs 05-Dec 2023 pdf.exe	efodnd.exe
PID 3004 wrote to memory of 1308	3004	efodnd.exe	efodnd.exe
PID 3004 wrote to memory of 1308	3004	efodnd.exe	efodnd.exe
PID 3004 wrote to memory of 1308	3004	efodnd.exe	efodnd.exe
PID 3004 wrote to memory of 1308	3004	efodnd.exe	efodnd.exe
PID 3004 wrote to memory of 1308	3004	efodnd.exe	efodnd.exe

outlook_office_path 1 IoCs

Processes:

efodnd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	efodnd.exe

outlook_win_path 1 IoCs

Processes:

efodnd.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	efodnd.exe

C:\Users\Admin\AppData\Local\Temp\Amendment POs 05-Dec 2023 pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Amendment POs 05-Dec 2023 pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Local\Temp\efodnd.exe
"C:\Users\Admin\AppData\Local\Temp\efodnd.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3004

C:\Users\Admin\AppData\Local\Temp\efodnd.exe
"C:\Users\Admin\AppData\Local\Temp\efodnd.exe"
3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\efodnd.exe

Filesize
174KB

MD5
f285d29783926bbdfe4dd3b372829d47

SHA1
7bb85fb8bc69bee4c6d89c82869e336cac5c9839

SHA256
e0ccf8d25441c9d696cc866894a7f4bb560eafdc52097621a99604de7d479331

SHA512
00abcc6a5a2630c89d9f262e989802693610855f20571608c6a427039f0a2964d2bb8002f0d9a9fde7a41855437948dc85de739f0634c8968ba4481b479a0ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\efodnd.exe

Filesize
174KB

MD5
f285d29783926bbdfe4dd3b372829d47

SHA1
7bb85fb8bc69bee4c6d89c82869e336cac5c9839

SHA256
e0ccf8d25441c9d696cc866894a7f4bb560eafdc52097621a99604de7d479331

SHA512
00abcc6a5a2630c89d9f262e989802693610855f20571608c6a427039f0a2964d2bb8002f0d9a9fde7a41855437948dc85de739f0634c8968ba4481b479a0ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\efodnd.exe

Filesize
174KB

MD5
f285d29783926bbdfe4dd3b372829d47

SHA1
7bb85fb8bc69bee4c6d89c82869e336cac5c9839

SHA256
e0ccf8d25441c9d696cc866894a7f4bb560eafdc52097621a99604de7d479331

SHA512
00abcc6a5a2630c89d9f262e989802693610855f20571608c6a427039f0a2964d2bb8002f0d9a9fde7a41855437948dc85de739f0634c8968ba4481b479a0ed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\uweoz.ec

Filesize
335KB

MD5
972723454318ba5a307ada9b512f4fdc

SHA1
3ff1c2d3c54b0c56f3d2f72d1d74dcef94212cb5

SHA256
73c05a16a7e52058cbc4c5cf8b9366fa39f9886b6aba09ce128ea257fd411b56

SHA512
01dc9d7e6abd46961152da4aad7a266d4fe2313dd6468851dfa37233d30f9555e93bcd5cd8ddadfc5d671e2bb56c151e4880d955af3bd5d6e89477d2dce3cfb7

Download Submit
\Users\Admin\AppData\Local\Temp\efodnd.exe

Filesize
174KB

MD5
f285d29783926bbdfe4dd3b372829d47

SHA1
7bb85fb8bc69bee4c6d89c82869e336cac5c9839

SHA256
e0ccf8d25441c9d696cc866894a7f4bb560eafdc52097621a99604de7d479331

SHA512
00abcc6a5a2630c89d9f262e989802693610855f20571608c6a427039f0a2964d2bb8002f0d9a9fde7a41855437948dc85de739f0634c8968ba4481b479a0ed5

Download Submit
\Users\Admin\AppData\Local\Temp\efodnd.exe

Filesize
174KB

MD5
f285d29783926bbdfe4dd3b372829d47

SHA1
7bb85fb8bc69bee4c6d89c82869e336cac5c9839

SHA256
e0ccf8d25441c9d696cc866894a7f4bb560eafdc52097621a99604de7d479331

SHA512
00abcc6a5a2630c89d9f262e989802693610855f20571608c6a427039f0a2964d2bb8002f0d9a9fde7a41855437948dc85de739f0634c8968ba4481b479a0ed5

Download Submit
memory/1308-15-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1308-22-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1308-27-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/1308-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1308-26-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/1308-16-0x0000000073AC0000-0x00000000741AE000-memory.dmp

Filesize
6.9MB

Download
memory/1308-17-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/1308-18-0x0000000001F10000-0x0000000001F52000-memory.dmp

Filesize
264KB

Download
memory/1308-19-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/1308-20-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/1308-10-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1308-23-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/1308-25-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/3004-6-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3004-14-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads