agenttesla | d2c7f98d63c1f4253862342b89500ec15717d4ccc6e4fd83e85d9e4a6488469d

General

Target
dhl_doc8532967438.exe
Size 548KB
Sample200707-c7ndsr9fka
SHA256 d2c7f98d63c1f4253862342b89500ec15717d4ccc6e4fd83e85d9e4a6488469d
MD5 6566b6e06e6bfa6f85d0e03591e3eb65
SHA1 99bb5abae2ab677a12553a4a6c4a14b8a72793e5
SHA512 0c6f9973f1fcd6bbdc269e675ee4bade19c0b1b14852dd13fdff60b5b8b70a570d6504fa232cc7f88247997ca6e1e23240aef02b376d5cbe926081025a38c9a0
MD5 SHA1 SHA512

Score

10^/10

Credentials

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 3872	3588	dhl_doc8532967438.exe	69

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3872	dhl_doc8532967438.exe
3872	dhl_doc8532967438.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3812	schtasks.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 3812	3588	dhl_doc8532967438.exe	67
PID 3588 wrote to memory of 3812	3588	dhl_doc8532967438.exe	67
PID 3588 wrote to memory of 3812	3588	dhl_doc8532967438.exe	67
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69
PID 3588 wrote to memory of 3872	3588	dhl_doc8532967438.exe	69

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	dhl_doc8532967438.exe

C:\Users\Admin\AppData\Local\Temp\dhl_doc8532967438.exe
"C:\Users\Admin\AppData\Local\Temp\dhl_doc8532967438.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VhxvYtZaYTvVd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp777D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3812
- C:\Users\Admin\AppData\Local\Temp\dhl_doc8532967438.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872