agenttesla | c901b6665268a9f5eeaa9e29c8fe5b9fbacbdce09be63191fc137ce573898fe7

General

Target
DHL00118309028PDF.EXE
Size 604KB
Sample201109-e1r81n5ytj
SHA256 c901b6665268a9f5eeaa9e29c8fe5b9fbacbdce09be63191fc137ce573898fe7
MD5 457f59f321661489327ed6839da58c77
SHA1 8abddb846d9dfce3b578f30fe7b7f7bb57064c7f
SHA512 3d38c06b8209dd004177dd1311d57532798b4525ca8ca090481dd842ce1e92cd00b6616347425be61eddcb48de7003bcf389879b5379272b56ccdabae3dd2e2e
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
ftp
Host
ftp.eden.ro
Port
21
Username
[email protected]
Password
3=2[hxR;}Uu8NN@ossyguru00998877

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	DHL00118309028PDF.EXE
File opened for modification	C:\Windows\assembly\Desktop.ini	DHL00118309028PDF.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4760 set thread context of 4220	4760	DHL00118309028PDF.EXE	75

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	DHL00118309028PDF.EXE
File opened for modification	C:\Windows\assembly\Desktop.ini	DHL00118309028PDF.EXE
File opened for modification	C:\Windows\assembly	DHL00118309028PDF.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4220	DHL00118309028PDF.EXE
4220	DHL00118309028PDF.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	DHL00118309028PDF.EXE
Token: SeDebugPrivilege	4220	DHL00118309028PDF.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4760 wrote to memory of 4220	4760	DHL00118309028PDF.EXE	75
PID 4220 wrote to memory of 912	4220	DHL00118309028PDF.EXE	79
PID 4220 wrote to memory of 912	4220	DHL00118309028PDF.EXE	79
PID 4220 wrote to memory of 912	4220	DHL00118309028PDF.EXE	79

C:\Users\Admin\AppData\Local\Temp\DHL00118309028PDF.EXE
"C:\Users\Admin\AppData\Local\Temp\DHL00118309028PDF.EXE"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\DHL00118309028PDF.EXE
  "{path}"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4220-2-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4220-4-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4220-5-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/4220-6-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads