agenttesla | 111cc331b218ace2b5e8efc945fdf81f1bb4219339dd85e6b844ee78cc452a0b

General

Target

SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
Size

1.2MB
MD5

c661e256cfb632d80724101a5f636d0a
SHA1

373d820d6de6e2b12f0c93919a7459c73d778e68
SHA256

a5469f28edbcd739343cc080853d0929dec5e2ee90cba53880a0b4f1f347c429
SHA512

0bf33f2c79236f88ccd3065a1b8791173105551c74c23be26a87bd31095c27743026b72ee4defd7cab22c2ee9b9f4f9c46d1f3d44a1ccbd22ebc98025dfaadaa
SSDEEP

24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8adaR8EdniRKBmYk43:/TvC/MTQYxsWR7ad88Snqcmg

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 api.ipify.org
23 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

SHIPPING DOCUMENT_AS41610T000745670_pdf.exe

description pid process target process

PID 1340 set thread context of 5056 1340 SHIPPING DOCUMENT_AS41610T000745670_pdf.exe RegSvcs.exe

flow	ioc
22	api.ipify.org
23	api.ipify.org

description	pid	process	target process
PID 1340 set thread context of 5056	1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

RegSvcs.exeSHIPPING DOCUMENT_AS41610T000745670_pdf.exeSHIPPING DOCUMENT_AS41610T000745670_pdf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

SHIPPING DOCUMENT_AS41610T000745670_pdf.exeSHIPPING DOCUMENT_AS41610T000745670_pdf.exe

pid process

2672 SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
1340 SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

5056 RegSvcs.exe
5056 RegSvcs.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

SHIPPING DOCUMENT_AS41610T000745670_pdf.exeSHIPPING DOCUMENT_AS41610T000745670_pdf.exe

pid process

2672 SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
1340 SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 5056 RegSvcs.exe

pid	process
5056	RegSvcs.exe
5056	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	5056	RegSvcs.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

SHIPPING DOCUMENT_AS41610T000745670_pdf.exeSHIPPING DOCUMENT_AS41610T000745670_pdf.exe

pid	process
2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

SHIPPING DOCUMENT_AS41610T000745670_pdf.exeSHIPPING DOCUMENT_AS41610T000745670_pdf.exe

pid	process
2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

SHIPPING DOCUMENT_AS41610T000745670_pdf.exeSHIPPING DOCUMENT_AS41610T000745670_pdf.exe

description	pid	process	target process
PID 2672 wrote to memory of 116	2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe
PID 2672 wrote to memory of 116	2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe
PID 2672 wrote to memory of 116	2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe
PID 2672 wrote to memory of 1340	2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
PID 2672 wrote to memory of 1340	2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
PID 2672 wrote to memory of 1340	2672	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
PID 1340 wrote to memory of 5056	1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe
PID 1340 wrote to memory of 5056	1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe
PID 1340 wrote to memory of 5056	1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe
PID 1340 wrote to memory of 5056	1340	SHIPPING DOCUMENT_AS41610T000745670_pdf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_AS41610T000745670_pdf.exe"
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_AS41610T000745670_pdf.exe"
2⤵
PID:116

C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_AS41610T000745670_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_AS41610T000745670_pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT_AS41610T000745670_pdf.exe"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autA930.tmp
Filesize
261KB

MD5
a510f161de49abd5e87d4a0a2457e25f

SHA1
284c2743100e76615c0c6c8689a9f9201328f066

SHA256
363b3acebd2be75921e1074acd63d36233abb82d4e45386822463a6c0ef736e3

SHA512
0b401ab1f5fbd6c405bacb640315c8001c7e152532eac548ca067843b621d0b74ef184ca3be610ed3034f71d7dcdb60c1abfe96241e6ec9130c98d16818ba3e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hepatoduodenostomy
Filesize
28KB

MD5
a39d47bab26aa81c9aa196581b8dcb4d

SHA1
db896a93c92d41d90a370791ae986e54269b53dc

SHA256
a4479e6b045da1de9a8a5e15d50885e3b09fd691d5b081ede17a9519987f131c

SHA512
82ee6a15290aab7cd240053bff5b16a809eb28d24134f9a670f32c2ca677881746b07e4f7e666e9e93de73384ce3796304ebc9f99223853aa55d8f6777740d5f

Download Submit
memory/2672-13-0x0000000000A60000-0x0000000000A64000-memory.dmp

Filesize
16KB

Download
memory/5056-28-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5056-30-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5056-29-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5056-31-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5056-32-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/5056-33-0x0000000005780000-0x00000000057D4000-memory.dmp

Filesize
336KB

Download
memory/5056-34-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/5056-36-0x0000000005EE0000-0x0000000006484000-memory.dmp

Filesize
5.6MB

Download
memory/5056-35-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/5056-37-0x0000000005860000-0x00000000058B2000-memory.dmp

Filesize
328KB

Download
memory/5056-45-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-47-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-83-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-99-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-97-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-96-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-94-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-91-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-89-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-87-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-86-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-82-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-79-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-77-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-75-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-73-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-71-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-69-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-67-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-65-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-63-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-61-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-59-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-57-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-53-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-51-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-50-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-43-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-41-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-56-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-39-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-38-0x0000000005860000-0x00000000058AC000-memory.dmp

Filesize
304KB

Download
memory/5056-1070-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/5056-1071-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/5056-1072-0x0000000007030000-0x0000000007080000-memory.dmp

Filesize
320KB

Download
memory/5056-1073-0x0000000007120000-0x00000000071B2000-memory.dmp

Filesize
584KB

Download
memory/5056-1074-0x0000000007090000-0x000000000709A000-memory.dmp

Filesize
40KB

Download
memory/5056-1075-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/5056-1076-0x000000007489E000-0x000000007489F000-memory.dmp

Filesize
4KB

Download
memory/5056-1077-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads