agenttesla | 7e8987e445e167c88b95a97849018508b3d791b49c4e30abd0640cc8ccf7d917

General

Target
DHL.exe
Size 506KB
Sample200810-b319k2cmh2
SHA256 7e8987e445e167c88b95a97849018508b3d791b49c4e30abd0640cc8ccf7d917
MD5 b45289f0ddb42d1da6139a86ae869fc4
SHA1 3e96293ae3e2d41caed457c33c2acf009a3a84e8
SHA512 8fc0de0a2a7a0e7d96776d9c2f7f0407f68c76a06137e66706784a945b3d400be5f1a4e7e66db2492487d5d1f64c1b1692aa16b011e31071de6840e865568b52
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1912	DHL.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1364	schtasks.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1364	1508	DHL.exe	26
PID 1508 wrote to memory of 1364	1508	DHL.exe	26
PID 1508 wrote to memory of 1364	1508	DHL.exe	26
PID 1508 wrote to memory of 1364	1508	DHL.exe	26
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28
PID 1508 wrote to memory of 1912	1508	DHL.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1912	DHL.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	DHL.exe
1912	DHL.exe

AgentTesla Payload 7 IoCs

keylogger stealer

resource	yara_rule
behavioral1/memory/1912-2-0x0000000000400000-0x000000000044A000-memory.dmp	agent_tesla
behavioral1/memory/1912-2-0x0000000000400000-0x000000000044A000-memory.dmp	agent_tesla
behavioral1/memory/1912-3-0x0000000000445C2E-mapping.dmp	agent_tesla
behavioral1/memory/1912-4-0x0000000000400000-0x000000000044A000-memory.dmp	agent_tesla
behavioral1/memory/1912-4-0x0000000000400000-0x000000000044A000-memory.dmp	agent_tesla
behavioral1/memory/1912-5-0x0000000000400000-0x000000000044A000-memory.dmp	agent_tesla
behavioral1/memory/1912-5-0x0000000000400000-0x000000000044A000-memory.dmp	agent_tesla

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1508 set thread context of 1912	1508	DHL.exe	28

C:\Users\Admin\AppData\Local\Temp\DHL.exe
"C:\Users\Admin\AppData\Local\Temp\DHL.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nSRpmqDBnPFtXs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED6A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1364
- C:\Users\Admin\AppData\Local\Temp\DHL.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1912