agenttesla | 96a994c8a1cd85aa5779b46052ad94a4fb72fbe8451ee8a8e6ae8be49a2bc458

General

Target
DHL-Waybill.PDF.exe
Size 692KB
Sample210929-ltc13aeefl
SHA256 96a994c8a1cd85aa5779b46052ad94a4fb72fbe8451ee8a8e6ae8be49a2bc458
MD5 3bcb68d06bbe199d7d903bd9bf7f9f63
SHA1 a74db066215fdb01756ccf7befb4db0929fb2efb
SHA512 c0138ce5cc075cdc2980b42cd9953b9e541830d4bebd3fbfde91e3ebd32b754b7521a09bb7c04c8ac9befc5c0ed2b9350c8be6bccf35698ff8a72ad2b9179e2f
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.germantwinscrews-de.com
Port
587
Username
[email protected]
Password
JDG3v8mw

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/752-61-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/752-62-0x000000000043779E-mapping.dmp	family_agenttesla
behavioral1/memory/752-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 752	1544	DHL-Waybill.PDF.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	752	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
752	MSBuild.exe
752	MSBuild.exe
1928	WerFault.exe
1928	WerFault.exe
1928	WerFault.exe
1928	WerFault.exe
1928	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	752	MSBuild.exe
Token: SeDebugPrivilege	1928	WerFault.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 1544 wrote to memory of 752	1544	DHL-Waybill.PDF.exe	27
PID 752 wrote to memory of 1928	752	MSBuild.exe	31
PID 752 wrote to memory of 1928	752	MSBuild.exe	31
PID 752 wrote to memory of 1928	752	MSBuild.exe	31
PID 752 wrote to memory of 1928	752	MSBuild.exe	31

C:\Users\Admin\AppData\Local\Temp\DHL-Waybill.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL-Waybill.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 1060
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-61-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/752-63-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/752-65-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Download

memory/1544-54-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/1544-56-0x0000000004C10000-0x0000000004C11000-memory.dmp

Download

memory/1544-57-0x0000000000670000-0x0000000000683000-memory.dmp

Download

memory/1544-58-0x0000000005C50000-0x0000000005CBC000-memory.dmp

Download

memory/1544-59-0x00000000006B0000-0x00000000006B2000-memory.dmp

Download

memory/1544-60-0x0000000007CC0000-0x0000000007D06000-memory.dmp

Download

memory/1928-67-0x00000000002C0000-0x0000000000300000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads