DHL SHIPPING INVOICE DOCUMENTS.doc

Tags

Signatures

• AgentTesla

  Description

  Agent Tesla is a remote access tool (RAT) written in visual basic.

  Tags

  keyloggertrojanstealerspywareagenttesla

• Blocklisted process makes network request

• Executes dropped EXE

• Loads dropped DLL

• Reads data files stored by FTP clients

  Description

  Tries to access configuration files associated with programs like FileZilla.

  Tags

  spyware

  TTPs

  Data from Local System Credentials in Files

• Reads user/profile data of local email clients

  Description

  Email clients store some user data on disk where infostealers will often target it.

  Tags

  spyware

  TTPs

  Data from Local System Credentials in Files

• Reads user/profile data of web browsers

  Description

  Infostealers often target stored browser data, which can include saved credentials etc.

  Tags

  spyware

  TTPs

  Data from Local System Credentials in Files

• Looks up external IP address via web service

  Description

  Uses a legitimate IP lookup service to find the infected system's external IP.

• Enumerates physical storage devices

  Description

  Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  Tags

  ransomware

  TTPs

  System Information Discovery

• Suspicious use of SetThreadContext

Related Tasks