agenttesla | ce83bccf11e2f79616c5fac945dce6e845aa1a3b7f027cc78f7a46cf7151af13

General

Target
DHL Shipment_Details.exe
Size 537KB
Sample200701-3f6v281spa
SHA256 ce83bccf11e2f79616c5fac945dce6e845aa1a3b7f027cc78f7a46cf7151af13
MD5 98781d0fd29d24d2186f558f39a90c34
SHA1 fb06a335d26db7ac09ce78124d6ddf28a3b7ae5f
SHA512 f7326245a576f12bd1eeee1e290c675879ed6340dd8958b1098626f263470b8b92f06dc479f9123516df2d73f87f3a4e5550af356d24af722c135c15aa44864b
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/812-4-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/812-5-0x00000000004474DE-mapping.dmp	family_agenttesla
behavioral1/memory/812-6-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/812-7-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\CpSnJ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CpSnJ\\CpSnJ.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 812	1108	DHL Shipment_Details.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1552	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1916	REG.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	DHL Shipment_Details.exe
Token: SeDebugPrivilege	812	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1552	1108	DHL Shipment_Details.exe	24
PID 1108 wrote to memory of 1552	1108	DHL Shipment_Details.exe	24
PID 1108 wrote to memory of 1552	1108	DHL Shipment_Details.exe	24
PID 1108 wrote to memory of 1552	1108	DHL Shipment_Details.exe	24
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 1108 wrote to memory of 812	1108	DHL Shipment_Details.exe	26
PID 812 wrote to memory of 1916	812	RegSvcs.exe	30
PID 812 wrote to memory of 1916	812	RegSvcs.exe	30
PID 812 wrote to memory of 1916	812	RegSvcs.exe	30
PID 812 wrote to memory of 1916	812	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\DHL Shipment_Details.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment_Details.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KRuDOIFQTers" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8AFF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\REG.exe
    REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System / v DisableTaskMgr / t REG_DWORD / d 1 / f
    3⤵
    - Modifies registry key
    PID:1916