agenttesla | 96a994c8a1cd85aa5779b46052ad94a4fb72fbe8451ee8a8e6ae8be49a2bc458

Analysis

max time kernel
143s
max time network
147s
platform
windows10_x64
resource
win10-en-20210920
submitted
29/09/2021, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL-Waybill.PDF.exe
Size 692KB
Sample210929-ltc13aeefl
SHA256 96a994c8a1cd85aa5779b46052ad94a4fb72fbe8451ee8a8e6ae8be49a2bc458
MD5 3bcb68d06bbe199d7d903bd9bf7f9f63
SHA1 a74db066215fdb01756ccf7befb4db0929fb2efb
SHA512 c0138ce5cc075cdc2980b42cd9953b9e541830d4bebd3fbfde91e3ebd32b754b7521a09bb7c04c8ac9befc5c0ed2b9350c8be6bccf35698ff8a72ad2b9179e2f
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.germantwinscrews-de.com
Port
587
Username
[email protected]
Password
JDG3v8mw

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2860-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2860-127-0x000000000043779E-mapping.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 2860	2208	DHL-Waybill.PDF.exe	72

Program crash 1 IoCs

pid	pid_target	Process	procid_target
552	2860	WerFault.exe	72

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2208	DHL-Waybill.PDF.exe
2208	DHL-Waybill.PDF.exe
2208	DHL-Waybill.PDF.exe
2208	DHL-Waybill.PDF.exe
2860	MSBuild.exe
2860	MSBuild.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe
552	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	DHL-Waybill.PDF.exe
Token: SeDebugPrivilege	2860	MSBuild.exe
Token: SeRestorePrivilege	552	WerFault.exe
Token: SeBackupPrivilege	552	WerFault.exe
Token: SeDebugPrivilege	552	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2784	2208	DHL-Waybill.PDF.exe	70
PID 2208 wrote to memory of 2784	2208	DHL-Waybill.PDF.exe	70
PID 2208 wrote to memory of 2784	2208	DHL-Waybill.PDF.exe	70
PID 2208 wrote to memory of 2796	2208	DHL-Waybill.PDF.exe	71
PID 2208 wrote to memory of 2796	2208	DHL-Waybill.PDF.exe	71
PID 2208 wrote to memory of 2796	2208	DHL-Waybill.PDF.exe	71
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72
PID 2208 wrote to memory of 2860	2208	DHL-Waybill.PDF.exe	72

C:\Users\Admin\AppData\Local\Temp\DHL-Waybill.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL-Waybill.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2796
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 1484
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-115-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/2208-117-0x00000000059F0000-0x00000000059F1000-memory.dmp

Download

memory/2208-118-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/2208-119-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/2208-120-0x0000000008A50000-0x0000000008A51000-memory.dmp

Download

memory/2208-121-0x00000000054F0000-0x00000000059EE000-memory.dmp

Download

memory/2208-122-0x00000000089B0000-0x00000000089C3000-memory.dmp

Download

memory/2208-123-0x0000000008FC0000-0x000000000902C000-memory.dmp

Download

memory/2208-124-0x0000000009030000-0x0000000009032000-memory.dmp

Download

memory/2208-125-0x0000000009050000-0x0000000009096000-memory.dmp

Download

memory/2860-126-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2860-132-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/2860-133-0x00000000056D0000-0x00000000056D1000-memory.dmp

Download

memory/2860-134-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

Download