agenttesla | eb56586394b02b762dd8e55ff044e31142f46b3d3efd143dac818a61784bc693

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Faktura Elexa_FV24103_pdf .scr
Size

31KB
MD5

98da04a6b0b83989d1bee2eda1ca6c50
SHA1

26a122571f8f81a40ce78b06d7c9d89b19923fac
SHA256

ffca66beb014d70ebd6242618f97426da7466ea3e3fcf033b7ec39e9c94d2bf8
SHA512

115237af29b47f5dbaa01db08e18a271717104e177c52c434e938e93cf4d58f8090e5fe5182228f3144adf55144f3b846d0c4fa245c2cc2434b8002836a5e83e
SSDEEP

768:c4UgWq/hHcO4x+BQC0WX57XDyaBNHVxYoAUQ/lX:c4fB8KBQC0kBTygVxLLqV

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.mediatrend.it
Port:
587
Username:
[email protected]
Password:
PugsmgkHD4

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mediatrend.it
Port:
587
Username:
[email protected]
Password:
PugsmgkHD4
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Faktura Elexa_FV24103_pdf .scr

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Axnxcpj = "C:\\Users\\Admin\\AppData\\Roaming\\Axnxcpj.exe"	Faktura Elexa_FV24103_pdf .scr

Suspicious use of SetThreadContext 1 IoCs

Processes:

Faktura Elexa_FV24103_pdf .scr

description pid process target process

PID 1544 set thread context of 2444 1544 Faktura Elexa_FV24103_pdf .scr Faktura Elexa_FV24103_pdf .scr
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Faktura Elexa_FV24103_pdf .scr

pid process

2444 Faktura Elexa_FV24103_pdf .scr
2444 Faktura Elexa_FV24103_pdf .scr
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Faktura Elexa_FV24103_pdf .scrFaktura Elexa_FV24103_pdf .scr

description pid process

Token: SeDebugPrivilege 1544 Faktura Elexa_FV24103_pdf .scr
Token: SeDebugPrivilege 1544 Faktura Elexa_FV24103_pdf .scr
Token: SeDebugPrivilege 2444 Faktura Elexa_FV24103_pdf .scr

description	pid	process	target process
PID 1544 set thread context of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr

pid	process
2444	Faktura Elexa_FV24103_pdf .scr
2444	Faktura Elexa_FV24103_pdf .scr

description	pid	process
Token: SeDebugPrivilege	1544	Faktura Elexa_FV24103_pdf .scr
Token: SeDebugPrivilege	1544	Faktura Elexa_FV24103_pdf .scr
Token: SeDebugPrivilege	2444	Faktura Elexa_FV24103_pdf .scr

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Faktura Elexa_FV24103_pdf .scr

description	pid	process	target process
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr
PID 1544 wrote to memory of 2444	1544	Faktura Elexa_FV24103_pdf .scr	Faktura Elexa_FV24103_pdf .scr

C:\Users\Admin\AppData\Local\Temp\Faktura Elexa_FV24103_pdf .scr
"C:\Users\Admin\AppData\Local\Temp\Faktura Elexa_FV24103_pdf .scr" /S
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\Faktura Elexa_FV24103_pdf .scr
"C:\Users\Admin\AppData\Local\Temp\Faktura Elexa_FV24103_pdf .scr"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Faktura Elexa_FV24103_pdf .scr.log
Filesize
1KB

MD5
f3eb81974dc5933681e933f07209ff5f

SHA1
7af8cae0f1d03e82daaf784df9886705685baac7

SHA256
e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

SHA512
d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

Download Submit
memory/1544-0-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/1544-1-0x0000000000640000-0x000000000064E000-memory.dmp

Filesize
56KB

Download
memory/1544-2-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/1544-3-0x0000000007370000-0x00000000075A2000-memory.dmp

Filesize
2.2MB

Download
memory/1544-4-0x0000000007B90000-0x0000000008134000-memory.dmp

Filesize
5.6MB

Download
memory/1544-5-0x00000000076E0000-0x0000000007772000-memory.dmp

Filesize
584KB

Download
memory/1544-7-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-6-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-9-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-21-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-27-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-25-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-23-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-17-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-15-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-19-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-13-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-12-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-33-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-31-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-36-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-43-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-39-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-37-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-41-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-29-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-45-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-49-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-47-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-63-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-67-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-70-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-65-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-61-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-59-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-57-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-55-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-53-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-51-0x0000000007370000-0x000000000759C000-memory.dmp

Filesize
2.2MB

Download
memory/1544-4892-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/1544-4894-0x00000000058B0000-0x00000000058FC000-memory.dmp

Filesize
304KB

Download
memory/1544-4893-0x0000000005840000-0x00000000058AC000-memory.dmp

Filesize
432KB

Download
memory/1544-4895-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/1544-4896-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/1544-4897-0x0000000000C20000-0x0000000000C74000-memory.dmp

Filesize
336KB

Download
memory/1544-4902-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/2444-4903-0x0000000000520000-0x0000000000560000-memory.dmp

Filesize
256KB

Download
memory/2444-4904-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/2444-4905-0x0000000004A30000-0x0000000004A96000-memory.dmp

Filesize
408KB

Download
memory/2444-4906-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/2444-4907-0x0000000005870000-0x00000000058C0000-memory.dmp

Filesize
320KB

Download
memory/2444-4908-0x0000000005960000-0x00000000059FC000-memory.dmp

Filesize
624KB

Download
memory/2444-4909-0x0000000005EB0000-0x0000000005EBA000-memory.dmp

Filesize
40KB

Download
memory/2444-4910-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download