agenttesla | e276b5f5931b82efa92a3d7a9e771b672c2e65fc69b04acb921ef96eff08f4f3

General

Target
DHL_document11022020680908911.exe
Size 908KB
Sample210517-e5dsr55wcs
SHA256 e276b5f5931b82efa92a3d7a9e771b672c2e65fc69b04acb921ef96eff08f4f3
MD5 bf6b420e7fca03ed5d8fa56223652820
SHA1 bee24952d9417951df216b4ce40a94e61703d915
SHA512 899d93877c0f2a6398cbb39e203a602c6a2cc92fca3f570062174200619a094390e107d7a6aead5013bcf419006c0cb99c217dd174d41d171861487828c37e34
MD5 SHA1 SHA512

Score

10^/10

agenttesla agilenet keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
bayermlb.com
Port
587
Username
[email protected]
Password
ifenna@A

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1716-78-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1716-79-0x0000000000437BDE-mapping.dmp	family_agenttesla
behavioral1/memory/1716-81-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Executes dropped EXE 2 IoCs

pid	Process
2040	windows.exe
1716	windows.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/336-63-0x0000000000B10000-0x0000000000B31000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows = "C:\\Users\\Admin\\Desktop\\windows.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1716	2040	windows.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
336	DHL_document11022020680908911.exe
336	DHL_document11022020680908911.exe
336	DHL_document11022020680908911.exe
336	DHL_document11022020680908911.exe
336	DHL_document11022020680908911.exe
2040	windows.exe
2040	windows.exe
1716	windows.exe
1716	windows.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	336	DHL_document11022020680908911.exe
Token: SeDebugPrivilege	2040	windows.exe
Token: SeDebugPrivilege	1716	windows.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 336 wrote to memory of 272	336	DHL_document11022020680908911.exe	29
PID 336 wrote to memory of 272	336	DHL_document11022020680908911.exe	29
PID 336 wrote to memory of 272	336	DHL_document11022020680908911.exe	29
PID 336 wrote to memory of 272	336	DHL_document11022020680908911.exe	29
PID 272 wrote to memory of 860	272	cmd.exe	31
PID 272 wrote to memory of 860	272	cmd.exe	31
PID 272 wrote to memory of 860	272	cmd.exe	31
PID 272 wrote to memory of 860	272	cmd.exe	31
PID 336 wrote to memory of 2040	336	DHL_document11022020680908911.exe	33
PID 336 wrote to memory of 2040	336	DHL_document11022020680908911.exe	33
PID 336 wrote to memory of 2040	336	DHL_document11022020680908911.exe	33
PID 336 wrote to memory of 2040	336	DHL_document11022020680908911.exe	33
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34
PID 2040 wrote to memory of 1716	2040	windows.exe	34

C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe
"C:\Users\Admin\AppData\Local\Temp\DHL_document11022020680908911.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "windows" /t REG_SZ /d "C:\Users\Admin\Desktop\windows.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:272
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "windows" /t REG_SZ /d "C:\Users\Admin\Desktop\windows.exe"
    3⤵
    - Adds Run key to start application
    PID:860
- C:\Users\Admin\Desktop\windows.exe
  "C:\Users\Admin\Desktop\windows.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Users\Admin\Desktop\windows.exe
    "C:\Users\Admin\Desktop\windows.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-61-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/336-63-0x0000000000B10000-0x0000000000B31000-memory.dmp

Download

memory/336-59-0x00000000012B0000-0x00000000012B1000-memory.dmp

Download

memory/336-66-0x0000000004A81000-0x0000000004A82000-memory.dmp

Download

memory/1716-78-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1716-81-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1716-83-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/2040-70-0x0000000000F20000-0x0000000000F21000-memory.dmp

Download

memory/2040-72-0x00000000049D0000-0x00000000049D1000-memory.dmp

Download

memory/2040-75-0x00000000049D1000-0x00000000049D2000-memory.dmp

Download

memory/2040-76-0x0000000000F10000-0x0000000000F1B000-memory.dmp

Download

memory/2040-77-0x0000000004830000-0x0000000004831000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads