agenttesla | be262b4a9cbad86462792c7a786b4041ee6b0123f884244693ede9d3174ee906

General

Target

Agreement ATC 02443 .pdf.exe
Size

835KB
MD5

e7d52516ca8bcf4e8bcaf71a36a88300
SHA1

d5a7eaad95ab6d4e492b128db0cf550c34170c90
SHA256

8df5ecbc8ea978c98c9c3a0918fe9ee233f169ee9e3d38855b7da8fc96aad8dc
SHA512

0dc86396301012e035ed03086436411b5abdbe7c2dc84b03d5385739250bf1efa1bc6fab96471eb277b62d7a3b1ea663565809493a26750951c6316b131c0751
SSDEEP

12288:+iEx72xrdlMXGnWnpLCzRdoJ6K5/w6ovt51qZ0o1LFMdDP+FIk7N:sSrdrWn4z26UNol510LFMdDP8Ik

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
u(!IUDW7
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Agreement ATC 02443 .pdf.exe

description pid process target process

PID 3004 set thread context of 2628 3004 Agreement ATC 02443 .pdf.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2580 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Agreement ATC 02443 .pdf.exepowershell.exepowershell.exeRegSvcs.exe

pid process

3004 Agreement ATC 02443 .pdf.exe
2728 powershell.exe
2988 powershell.exe
3004 Agreement ATC 02443 .pdf.exe
2628 RegSvcs.exe
2628 RegSvcs.exe

flow	ioc
4	ip-api.com

description	pid	process	target process
PID 3004 set thread context of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe

pid	process
2580	schtasks.exe

pid	process
3004	Agreement ATC 02443 .pdf.exe
2728	powershell.exe
2988	powershell.exe
3004	Agreement ATC 02443 .pdf.exe
2628	RegSvcs.exe
2628	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Agreement ATC 02443 .pdf.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3004	Agreement ATC 02443 .pdf.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2628	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Agreement ATC 02443 .pdf.exe

description	pid	process	target process
PID 3004 wrote to memory of 2988	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2988	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2988	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2988	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2728	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2728	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2728	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2728	3004	Agreement ATC 02443 .pdf.exe	powershell.exe
PID 3004 wrote to memory of 2580	3004	Agreement ATC 02443 .pdf.exe	schtasks.exe
PID 3004 wrote to memory of 2580	3004	Agreement ATC 02443 .pdf.exe	schtasks.exe
PID 3004 wrote to memory of 2580	3004	Agreement ATC 02443 .pdf.exe	schtasks.exe
PID 3004 wrote to memory of 2580	3004	Agreement ATC 02443 .pdf.exe	schtasks.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe
PID 3004 wrote to memory of 2628	3004	Agreement ATC 02443 .pdf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Agreement ATC 02443 .pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Agreement ATC 02443 .pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Agreement ATC 02443 .pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\emaGqYHYeYNHas.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\emaGqYHYeYNHas" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp"
2⤵
- Creates scheduled task(s)
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp
Filesize
1KB

MD5
2f77c13b506417b7a4986503982a585b

SHA1
dc772f6daa643b3376913e4e5912c4b2dd5138bd

SHA256
fcf8eec0c7ca6cfd17462337ed68ee466d2ba48414375db3cb0708a64ecfd199

SHA512
94abca964a5a65d5b35c6fbf9473889043da4fc12cf3834452ab283c75707cad15717b69de9ece35e46fb0d49ce964037344d2bee469d86643c22bd573d3c734

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
bc810e71d27a369a1141deec88bf18cd

SHA1
0dde126d784e2b05ac2d2ae6eb8d51f7cbeee672

SHA256
1efc1b58d29a8f1b9e6e7c8e7c9ab9ff247156c2e15d4bfe0a0e966897a3a30d

SHA512
df010520920717d7cac470243fb38c1f557254efdf0a0bb7acfe7cca948a7c760121070ce212a67b56b2ee0d4d9db715e660676cacd2473a755be8073f52e06f

Download Submit
memory/2628-30-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2628-26-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2628-48-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-45-0x0000000004B10000-0x0000000004B50000-memory.dmp

Filesize
256KB

Download
memory/2628-44-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-43-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2628-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2628-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2628-38-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2628-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-22-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2628-49-0x0000000004B10000-0x0000000004B50000-memory.dmp

Filesize
256KB

Download
memory/2728-47-0x000000006F070000-0x000000006F61B000-memory.dmp

Filesize
5.7MB

Download
memory/2728-28-0x000000006F070000-0x000000006F61B000-memory.dmp

Filesize
5.7MB

Download
memory/2728-24-0x000000006F070000-0x000000006F61B000-memory.dmp

Filesize
5.7MB

Download
memory/2728-25-0x0000000001CF0000-0x0000000001D30000-memory.dmp

Filesize
256KB

Download
memory/2728-29-0x0000000001CF0000-0x0000000001D30000-memory.dmp

Filesize
256KB

Download
memory/2988-21-0x000000006F070000-0x000000006F61B000-memory.dmp

Filesize
5.7MB

Download
memory/2988-35-0x0000000002D10000-0x0000000002D50000-memory.dmp

Filesize
256KB

Download
memory/2988-33-0x0000000002D10000-0x0000000002D50000-memory.dmp

Filesize
256KB

Download
memory/2988-31-0x0000000002D10000-0x0000000002D50000-memory.dmp

Filesize
256KB

Download
memory/2988-46-0x000000006F070000-0x000000006F61B000-memory.dmp

Filesize
5.7MB

Download
memory/2988-20-0x000000006F070000-0x000000006F61B000-memory.dmp

Filesize
5.7MB

Download
memory/3004-42-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-0-0x0000000000040000-0x0000000000118000-memory.dmp

Filesize
864KB

Download
memory/3004-7-0x00000000002B0000-0x0000000000334000-memory.dmp

Filesize
528KB

Download
memory/3004-6-0x0000000004A20000-0x0000000004AAC000-memory.dmp

Filesize
560KB

Download
memory/3004-5-0x0000000000410000-0x0000000000424000-memory.dmp

Filesize
80KB

Download
memory/3004-3-0x00000000003E0000-0x00000000003F8000-memory.dmp

Filesize
96KB

Download
memory/3004-2-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Filesize
256KB

Download
memory/3004-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3004-1-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads