agenttesla | 51837e07f216a7af44fbabf5a9e0b91dcbc2dfd3c3428badf554049a193938cf

General

Target
DHL_Confirmation_CBJ190517000131RMs.exe
Size 573KB
Sample201109-dcptj9s736
SHA256 51837e07f216a7af44fbabf5a9e0b91dcbc2dfd3c3428badf554049a193938cf
MD5 de5d4464be06fa32db6a46ddd41880a1
SHA1 4a0c8c04d4935a207588c4a126a0e2d8e3a2a801
SHA512 1fbb726932ba815ca193ecaf9664f51b98d0917f5495b8de02a3689ffaa95d75ddb6fc1518971ab8211628ee354ed91dbf75d3b823f49ce97323e19eb2a9fd00
MD5 SHA1 SHA512

Score

10^/10

Family

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1844-82-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1844-83-0x000000000044CA4E-mapping.dmp	family_agenttesla
behavioral1/memory/1844-84-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1844-85-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	DHL_Confirmation_CBJ190517000131RMs.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	DHL_Confirmation_CBJ190517000131RMs.exe
Token: SeDebugPrivilege	1844	DHL_Confirmation_CBJ190517000131RMs.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 988	1904	DHL_Confirmation_CBJ190517000131RMs.exe	29
PID 1904 wrote to memory of 988	1904	DHL_Confirmation_CBJ190517000131RMs.exe	29
PID 1904 wrote to memory of 988	1904	DHL_Confirmation_CBJ190517000131RMs.exe	29
PID 1904 wrote to memory of 988	1904	DHL_Confirmation_CBJ190517000131RMs.exe	29
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1904 wrote to memory of 1844	1904	DHL_Confirmation_CBJ190517000131RMs.exe	31
PID 1844 wrote to memory of 1684	1844	DHL_Confirmation_CBJ190517000131RMs.exe	33
PID 1844 wrote to memory of 1684	1844	DHL_Confirmation_CBJ190517000131RMs.exe	33
PID 1844 wrote to memory of 1684	1844	DHL_Confirmation_CBJ190517000131RMs.exe	33
PID 1844 wrote to memory of 1684	1844	DHL_Confirmation_CBJ190517000131RMs.exe	33

C:\Users\Admin\AppData\Local\Temp\DHL_Confirmation_CBJ190517000131RMs.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_Confirmation_CBJ190517000131RMs.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kfcsBXRXeQVK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6586.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:988
- C:\Users\Admin\AppData\Local\Temp\DHL_Confirmation_CBJ190517000131RMs.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:1684