agenttesla | 394fda858d125629741feb8afcc89b15425f643549097507d28a37338cff57ef

General

Target

DHL SHIPMENT NOTIFICATION 284748395PD.exe
Size

478KB
MD5

ad87619820aa1c150c35ef8bdb4a6b09
SHA1

169c4b930585e5c4212662d208c7b7f66a692dc1
SHA256

394fda858d125629741feb8afcc89b15425f643549097507d28a37338cff57ef
SHA512

8fcf068d41beeeac5f7e6b8465ad0ef44a723665e89453fc1ca465a6e535e1be12fc08bf2fcf83db1317042bdae85d6147f02b98b2bc75d53613cee53083f1f9

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.aclthyaexports.net
Port:
587
Username:
[email protected]
Password:
User@@12345

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3568-131-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3568-132-0x00000000004375BE-mapping.dmp	family_agenttesla
behavioral2/memory/3568-140-0x0000000004D20000-0x000000000521E000-memory.dmp	family_agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtWThAJ = "C:\\Users\\Admin\\AppData\\Roaming\\rtWThAJ\\rtWThAJ.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL SHIPMENT NOTIFICATION 284748395PD.exe

description pid process target process

PID 3632 set thread context of 3568 3632 DHL SHIPMENT NOTIFICATION 284748395PD.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

400 schtasks.exe

description	pid	process	target process
PID 3632 set thread context of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe

pid	process
400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

DHL SHIPMENT NOTIFICATION 284748395PD.exeRegSvcs.exepowershell.exe

pid	process
3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe
3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe
3568	RegSvcs.exe
3568	RegSvcs.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL SHIPMENT NOTIFICATION 284748395PD.exeRegSvcs.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe
Token: SeDebugPrivilege	3568	RegSvcs.exe
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

DHL SHIPMENT NOTIFICATION 284748395PD.exe

description	pid	process	target process
PID 3632 wrote to memory of 1636	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	powershell.exe
PID 3632 wrote to memory of 1636	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	powershell.exe
PID 3632 wrote to memory of 1636	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	powershell.exe
PID 3632 wrote to memory of 400	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	schtasks.exe
PID 3632 wrote to memory of 400	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	schtasks.exe
PID 3632 wrote to memory of 400	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	schtasks.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe
PID 3632 wrote to memory of 3568	3632	DHL SHIPMENT NOTIFICATION 284748395PD.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\DHL SHIPMENT NOTIFICATION 284748395PD.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPMENT NOTIFICATION 284748395PD.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eZwlvsggO.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eZwlvsggO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1D43.tmp"
2⤵
- Creates scheduled task(s)
PID:400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1D43.tmp
MD5
da82ad8ff0ed9c79172babeb45327002

SHA1
b2480649c06a640f2265d4e5a6f1c3f774001e12

SHA256
bd061cc85a98111e062edf9bbcb5fe6a8788c0ada0b58bc1034a249b0cc13e0f

SHA512
995a639c00f2764648143a75f5a742cab0f3b7f5368939be46b0b6ef268a8a9942d9ceca60abb6850f3ec9272ff791d7b6ac508a6055ee964639f093387af6c9

Download Submit
memory/400-125-0x0000000000000000-mapping.dmp

Download
memory/1636-144-0x0000000007A80000-0x0000000007A81000-memory.dmp

Filesize
4KB

Download
memory/1636-167-0x000000007F700000-0x000000007F701000-memory.dmp

Filesize
4KB

Download
memory/1636-168-0x0000000004823000-0x0000000004824000-memory.dmp

Filesize
4KB

Download
memory/1636-137-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/1636-166-0x00000000091E0000-0x00000000091E1000-memory.dmp

Filesize
4KB

Download
memory/1636-161-0x0000000009080000-0x0000000009081000-memory.dmp

Filesize
4KB

Download
memory/1636-138-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/1636-154-0x00000000090A0000-0x00000000090D3000-memory.dmp

Filesize
204KB

Download
memory/1636-126-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1636-127-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1636-147-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1636-129-0x0000000004830000-0x0000000004831000-memory.dmp

Filesize
4KB

Download
memory/1636-130-0x00000000072B0000-0x00000000072B1000-memory.dmp

Filesize
4KB

Download
memory/1636-146-0x00000000082E0000-0x00000000082E1000-memory.dmp

Filesize
4KB

Download
memory/1636-169-0x0000000009600000-0x0000000009601000-memory.dmp

Filesize
4KB

Download
memory/1636-145-0x0000000008570000-0x0000000008571000-memory.dmp

Filesize
4KB

Download
memory/1636-124-0x0000000000000000-mapping.dmp

Download
memory/1636-139-0x0000000004822000-0x0000000004823000-memory.dmp

Filesize
4KB

Download
memory/1636-143-0x0000000007C10000-0x0000000007C11000-memory.dmp

Filesize
4KB

Download
memory/1636-141-0x0000000007950000-0x0000000007951000-memory.dmp

Filesize
4KB

Download
memory/1636-142-0x00000000079C0000-0x00000000079C1000-memory.dmp

Filesize
4KB

Download
memory/3568-140-0x0000000004D20000-0x000000000521E000-memory.dmp

Filesize
5.0MB

Download
memory/3568-131-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3568-132-0x00000000004375BE-mapping.dmp

Download
memory/3632-115-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/3632-119-0x0000000004CD0000-0x00000000051CE000-memory.dmp

Filesize
5.0MB

Download
memory/3632-117-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/3632-118-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/3632-123-0x00000000084D0000-0x000000000853A000-memory.dmp

Filesize
424KB

Download
memory/3632-122-0x00000000051C0000-0x00000000051C6000-memory.dmp

Filesize
24KB

Download
memory/3632-121-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/3632-120-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads