agenttesla | 0cb9e417f6d669eb497a3c451a30744cbe7b4bb5f7acb01d55956e1021303d2a

General

Target

DHL CONSIGNMENT.exe
Size

618KB
MD5

79fb855aaf091f26878c36f083003542
SHA1

2db4295fd44057bd343108b1551c90187e16b29d
SHA256

0cb9e417f6d669eb497a3c451a30744cbe7b4bb5f7acb01d55956e1021303d2a
SHA512

8574b2a01d12069e96e4c2c91504cb072e357ac17fd57030985e23dd0a3afad3d8b74c8e3c32850fcfe036ef1c4a4d1789ef44c4a47c1b85637f56d83a51f6e1

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.anding-tw.com
Port:
587
Username:
ahmed@anding-tw.com
Password:
f$Y$20vPan*h

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2128-16-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/2128-17-0x000000000044CD1E-mapping.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/4680-13-0x00000000077D0000-0x0000000007823000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL CONSIGNMENT.exe

description pid process target process

PID 4680 set thread context of 2128 4680 DHL CONSIGNMENT.exe DHL CONSIGNMENT.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3172 schtasks.exe

description	pid	process	target process
PID 4680 set thread context of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe

pid	process
3172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

DHL CONSIGNMENT.exeDHL CONSIGNMENT.exe

pid	process
4680	DHL CONSIGNMENT.exe
4680	DHL CONSIGNMENT.exe
4680	DHL CONSIGNMENT.exe
4680	DHL CONSIGNMENT.exe
4680	DHL CONSIGNMENT.exe
2128	DHL CONSIGNMENT.exe
2128	DHL CONSIGNMENT.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHL CONSIGNMENT.exeDHL CONSIGNMENT.exe

description pid process

Token: SeDebugPrivilege 4680 DHL CONSIGNMENT.exe
Token: SeDebugPrivilege 2128 DHL CONSIGNMENT.exe

description	pid	process
Token: SeDebugPrivilege	4680	DHL CONSIGNMENT.exe
Token: SeDebugPrivilege	2128	DHL CONSIGNMENT.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

DHL CONSIGNMENT.exeDHL CONSIGNMENT.exe

description	pid	process	target process
PID 4680 wrote to memory of 3172	4680	DHL CONSIGNMENT.exe	schtasks.exe
PID 4680 wrote to memory of 3172	4680	DHL CONSIGNMENT.exe	schtasks.exe
PID 4680 wrote to memory of 3172	4680	DHL CONSIGNMENT.exe	schtasks.exe
PID 4680 wrote to memory of 2476	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2476	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2476	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 4680 wrote to memory of 2128	4680	DHL CONSIGNMENT.exe	DHL CONSIGNMENT.exe
PID 2128 wrote to memory of 1460	2128	DHL CONSIGNMENT.exe	netsh.exe
PID 2128 wrote to memory of 1460	2128	DHL CONSIGNMENT.exe	netsh.exe
PID 2128 wrote to memory of 1460	2128	DHL CONSIGNMENT.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\DHL CONSIGNMENT.exe
"C:\Users\Admin\AppData\Local\Temp\DHL CONSIGNMENT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zdDHaPe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp932D.tmp"
2⤵
- Creates scheduled task(s)
PID:3172

C:\Users\Admin\AppData\Local\Temp\DHL CONSIGNMENT.exe
"{path}"
2⤵
PID:2476

C:\Users\Admin\AppData\Local\Temp\DHL CONSIGNMENT.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1460

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL CONSIGNMENT.exe.log
MD5
eb5671ffebe9f5efc131e23b475adba2

SHA1
e3a732a93981c7fdfc75c2f00faa867a4d4123e8

SHA256
dcc5422ad3e1070822b706e596af50e34ab07dc44942bde90ccaecd06fd6ee0b

SHA512
aebaa2573ed87dd3a5bcbc135674e0273e65ce4796ce81a461518fe1184687e27d6139f684eba590efc2bbf3e2a266caf47792449d02d9886635761349e78897

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp932D.tmp
MD5
7a1e746b1faf6a48e35fe988abaf88bd

SHA1
87a05b4d359156b4d3244fce22916d7e60340ee8

SHA256
cb0e087b329240918f173c4f7210df07a1d8d8397b8fd3105b9c5c2db485655d

SHA512
54782fc1f99e8830f37b730100b2dbcbc90b56f752ccd837cbc7c29dd0f5e6052b657a99528dc83c6847d4ebff5f43bd01d0feccde0232c3bbee9b5595d72f58

Download Submit
memory/1460-26-0x0000000000000000-mapping.dmp

Download
memory/2128-25-0x00000000064B0000-0x00000000064B1000-memory.dmp

Filesize
4KB

Download
memory/2128-24-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download
memory/2128-19-0x0000000073430000-0x0000000073B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2128-17-0x000000000044CD1E-mapping.dmp

Download
memory/2128-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3172-14-0x0000000000000000-mapping.dmp

Download
memory/4680-8-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/4680-13-0x00000000077D0000-0x0000000007823000-memory.dmp

Filesize
332KB

Download
memory/4680-12-0x0000000009350000-0x0000000009351000-memory.dmp

Filesize
4KB

Download
memory/4680-11-0x00000000063E0000-0x00000000063E3000-memory.dmp

Filesize
12KB

Download
memory/4680-10-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Filesize
4KB

Download
memory/4680-9-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/4680-0-0x0000000073430000-0x0000000073B1E000-memory.dmp

Filesize
6.9MB

Download
memory/4680-5-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/4680-4-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/4680-3-0x0000000007770000-0x00000000077CA000-memory.dmp

Filesize
360KB

Download
memory/4680-1-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads