agenttesla | 0cb9e417f6d669eb497a3c451a30744cbe7b4bb5f7acb01d55956e1021303d2a

General

Target

DHL CONSIGNMENT.exe
Size

618KB
MD5

79fb855aaf091f26878c36f083003542
SHA1

2db4295fd44057bd343108b1551c90187e16b29d
SHA256

0cb9e417f6d669eb497a3c451a30744cbe7b4bb5f7acb01d55956e1021303d2a
SHA512

8574b2a01d12069e96e4c2c91504cb072e357ac17fd57030985e23dd0a3afad3d8b74c8e3c32850fcfe036ef1c4a4d1789ef44c4a47c1b85637f56d83a51f6e1

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.anding-tw.com
Port:
587
Username:
ahmed@anding-tw.com
Password:
f$Y$20vPan*h

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/596-38-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/596-39-0x000000000044CD1E-mapping.dmp	family_agenttesla
behavioral1/memory/596-40-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/596-41-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1804-34-0x0000000001F60000-0x0000000001FB3000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL CONSIGNMENT.exe

description pid process target process

PID 1804 set thread context of 596 1804 DHL CONSIGNMENT.exe DHL CONSIGNMENT.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1780 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

DHL CONSIGNMENT.exeDHL CONSIGNMENT.exe

pid process

1804 DHL CONSIGNMENT.exe
1804 DHL CONSIGNMENT.exe
596 DHL CONSIGNMENT.exe
596 DHL CONSIGNMENT.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHL CONSIGNMENT.exeDHL CONSIGNMENT.exe

description pid process

Token: SeDebugPrivilege 1804 DHL CONSIGNMENT.exe
Token: SeDebugPrivilege 596 DHL CONSIGNMENT.exe

description	pid	process	target process
PID 1804 set thread context of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe

pid	process
1780	schtasks.exe

pid	process
1804	DHL CONSIGNMENT.exe
1804	DHL CONSIGNMENT.exe
596	DHL CONSIGNMENT.exe
596	DHL CONSIGNMENT.exe

description	pid	process
Token: SeDebugPrivilege	1804	DHL CONSIGNMENT.exe
Token: SeDebugPrivilege	596	DHL CONSIGNMENT.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

DHL CONSIGNMENT.exeDHL CONSIGNMENT.exe

description	pid	process	target process
PID 1804 wrote to memory of 1780	1804	DHL CONSIGNMENT.exe	schtasks.exe
PID 1804 wrote to memory of 1780	1804	DHL CONSIGNMENT.exe	schtasks.exe
PID 1804 wrote to memory of 1780	1804	DHL CONSIGNMENT.exe	schtasks.exe
PID 1804 wrote to memory of 1780	1804	DHL CONSIGNMENT.exe	schtasks.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 1804 wrote to memory of 596	1804	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 596 wrote to memory of 1696	596	DHL CONSIGNMENT.exe	netsh.exe
PID 596 wrote to memory of 1696	596	DHL CONSIGNMENT.exe	netsh.exe
PID 596 wrote to memory of 1696	596	DHL CONSIGNMENT.exe	netsh.exe
PID 596 wrote to memory of 1696	596	DHL CONSIGNMENT.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\DHL CONSIGNMENT.exe
"C:\Users\Admin\AppData\Local\Temp\DHL CONSIGNMENT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zdDHaPe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D24.tmp"
2⤵
- Creates scheduled task(s)
PID:1780

C:\Users\Admin\AppData\Local\Temp\DHL CONSIGNMENT.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1696

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6D24.tmp
MD5
6e9a14695bde17d3c50f511813420d97

SHA1
66b1d0c8e7e77d167edf50271a39a53a36af2088

SHA256
f2dde1516cfe1dd22cb3c015bc41f412132090a2644923843337bd19ddb20932

SHA512
fa4aedd261596232c457cd99a9229141e96d337bae508c7c43e1b352a455730c854abb27ae5e517c481610a7e0c284d896cc3edbd2b0307b872b93ec1bfdd9c9

Download Submit
memory/596-42-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/596-41-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/596-40-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/596-39-0x000000000044CD1E-mapping.dmp

Download
memory/596-38-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1696-45-0x0000000000000000-mapping.dmp

Download
memory/1780-35-0x0000000000000000-mapping.dmp

Download
memory/1804-4-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/1804-34-0x0000000001F60000-0x0000000001FB3000-memory.dmp

Filesize
332KB

Download
memory/1804-33-0x00000000006B0000-0x00000000006B3000-memory.dmp

Filesize
12KB

Download
memory/1804-9-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/1804-0-0x0000000074110000-0x00000000747FE000-memory.dmp

Filesize
6.9MB

Download
memory/1804-3-0x0000000000500000-0x000000000055A000-memory.dmp

Filesize
360KB

Download
memory/1804-1-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads