agenttesla | 93a14ff6939402cf7f901e957af60c6cde36fc18c0e3b20493c12c5177d04523

General

Target

DHL DOCS.exe
Size

317KB
MD5

6e4118c7371981515f696082234c7915
SHA1

bf560e28cd6d9f5854b3e334d82db9d80815560c
SHA256

93a14ff6939402cf7f901e957af60c6cde36fc18c0e3b20493c12c5177d04523
SHA512

53079ee352d7411fa4311d8465a871cb062642163b42dc8bbc1ccb662068f94b3c4e5dfcfa8533ce104783d174ddb3f3a85276e4c367c627fb072370f4f60a0e

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp-mail.outlook.com
Port:
587
Username:
[email protected]
Password:
Darumshaker@123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4032-3-0x0000000000400000-0x000000000044D000-memory.dmp	family_agenttesla
behavioral2/memory/4032-5-0x0000000002AC0000-0x0000000002AF7000-memory.dmp	family_agenttesla

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

DHL DOCS.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Task Scheduler Engine = "C:\\Users\\Admin\\AppData\\Roaming\\Task Scheduler Engine\\Task Scheduler Engine.exe"	DHL DOCS.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

DHL DOCS.exe

pid process

4032 DHL DOCS.exe
4032 DHL DOCS.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

DHL DOCS.exe

pid process

4032 DHL DOCS.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DHL DOCS.exe

description pid process

Token: SeDebugPrivilege 4032 DHL DOCS.exe

pid	process
4032	DHL DOCS.exe
4032	DHL DOCS.exe

pid	process
4032	DHL DOCS.exe

description	pid	process
Token: SeDebugPrivilege	4032	DHL DOCS.exe

C:\Users\Admin\AppData\Local\Temp\DHL DOCS.exe
"C:\Users\Admin\AppData\Local\Temp\DHL DOCS.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4032

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4032-3-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4032-2-0x0000000072DD0000-0x00000000734BE000-memory.dmp

Filesize
6.9MB

Download
memory/4032-4-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4032-5-0x0000000002AC0000-0x0000000002AF7000-memory.dmp

Filesize
220KB

Download
memory/4032-7-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/4032-8-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/4032-9-0x00000000050D2000-0x00000000050D3000-memory.dmp

Filesize
4KB

Download
memory/4032-10-0x00000000050D3000-0x00000000050D4000-memory.dmp

Filesize
4KB

Download
memory/4032-11-0x00000000050D4000-0x00000000050D5000-memory.dmp

Filesize
4KB

Download
memory/4032-12-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/4032-13-0x0000000006140000-0x0000000006141000-memory.dmp

Filesize
4KB

Download
memory/4032-14-0x0000000006250000-0x0000000006251000-memory.dmp

Filesize
4KB

Download
memory/4032-15-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing