agenttesla | 1fe5c63b01b1faf6d5df0ad3cb8a369b3866ec6cbb6145e7dca11e5a5e49cfd0

General

Target

DHLHAWB 57462839.exe
Size

539KB
MD5

937409ab4d04460da3a61a8af49940f4
SHA1

1a41e87a25ae680a94edd0a47c09bb28fa76b661
SHA256

1fe5c63b01b1faf6d5df0ad3cb8a369b3866ec6cbb6145e7dca11e5a5e49cfd0
SHA512

583033c8dbd083f90b4036461d0d718f8f45a9bed31f4e449e075a045993421f0d2d4c42f57f92483391405274f388e8154fed044b879caf0aea5a6187410f50

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
VuVW%xY7ceo

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1068-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1068-11-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/1068-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

DHLHAWB 57462839.exe

description pid process target process

PID 1684 set thread context of 1068 1684 DHLHAWB 57462839.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1216 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

DHLHAWB 57462839.exeRegSvcs.exe

pid process

1684 DHLHAWB 57462839.exe
1684 DHLHAWB 57462839.exe
1684 DHLHAWB 57462839.exe
1068 RegSvcs.exe
1068 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DHLHAWB 57462839.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1684 DHLHAWB 57462839.exe
Token: SeDebugPrivilege 1068 RegSvcs.exe

description	pid	process	target process
PID 1684 set thread context of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe

pid	process
1216	schtasks.exe

pid	process
1684	DHLHAWB 57462839.exe
1684	DHLHAWB 57462839.exe
1684	DHLHAWB 57462839.exe
1068	RegSvcs.exe
1068	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1684	DHLHAWB 57462839.exe
Token: SeDebugPrivilege	1068	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

DHLHAWB 57462839.exe

description	pid	process	target process
PID 1684 wrote to memory of 1216	1684	DHLHAWB 57462839.exe	schtasks.exe
PID 1684 wrote to memory of 1216	1684	DHLHAWB 57462839.exe	schtasks.exe
PID 1684 wrote to memory of 1216	1684	DHLHAWB 57462839.exe	schtasks.exe
PID 1684 wrote to memory of 1216	1684	DHLHAWB 57462839.exe	schtasks.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe
PID 1684 wrote to memory of 1068	1684	DHLHAWB 57462839.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\DHLHAWB 57462839.exe
"C:\Users\Admin\AppData\Local\Temp\DHLHAWB 57462839.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UNOnVCSOZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA351.tmp"
2⤵
- Creates scheduled task(s)
PID:1216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA351.tmp
MD5
535be56a43009b68b7408b24164dc47b

SHA1
e358bd7a4c685bc710e4dc177b153fcc28cee5b0

SHA256
3281ee16a1a9bd132243a46b8d1d9f1386f0f3493cbb4cfe4b9e0ee93a664e22

SHA512
e417ea37f6f2f4fc58a382c86af304785e28a7246b90a45146d3bebcfb7f611d4b43f54558319e00c1102289268be3d4182e749b0f849f931780189298ec0d3d

Download Submit
memory/1068-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1068-11-0x000000000043760E-mapping.dmp

Download
memory/1068-12-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/1068-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1068-15-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/1216-8-0x0000000000000000-mapping.dmp

Download
memory/1684-2-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-3-0x0000000000F00000-0x0000000000F01000-memory.dmp

Filesize
4KB

Download
memory/1684-5-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/1684-6-0x00000000094B0000-0x000000000D4AD000-memory.dmp

Filesize
64.0MB

Download
memory/1684-7-0x0000000004F30000-0x0000000004F8C000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads