agenttesla | 0f2179bdea52208747bcd067addc90ad13120aa936c9bda8c319a51b6d8715d0

General

Target

Your new dhl delivery needs your attention to complete.exe
Size

300.0MB
MD5

b41efc1903f715c9de2bc95f2658fec8
SHA1

9ed3a81ae8a2c32a35b67df0d640cea7e18dfbc2
SHA256

53cdcdb4a33a697bcc90680e2e9b8e757b1ff04c0ff75acbeb86434d0aef6670
SHA512

63680e9bc9bd1c65bd8507a44cf54cc4548728b2a5fbef143b990c026e4f72ef80c2b2b06072d36da5480bfe810384b061001dc6140c968ef4b68468edf410d0

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5279095555:AAE4HwAzPbUle9whPqEu6faWeNRU-6BRHps/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Your new dhl delivery needs your attention to complete.exe

description pid process target process

PID 2864 set thread context of 4964 2864 Your new dhl delivery needs your attention to complete.exe vbc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

4964 vbc.exe
4964 vbc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vbc.exe

description pid process

Token: SeDebugPrivilege 4964 vbc.exe

description	pid	process	target process
PID 2864 set thread context of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe

pid	process
4964	vbc.exe
4964	vbc.exe

description	pid	process
Token: SeDebugPrivilege	4964	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Your new dhl delivery needs your attention to complete.exe

description	pid	process	target process
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe
PID 2864 wrote to memory of 4964	2864	Your new dhl delivery needs your attention to complete.exe	vbc.exe

outlook_office_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Your new dhl delivery needs your attention to complete.exe
"C:\Users\Admin\AppData\Local\Temp\Your new dhl delivery needs your attention to complete.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2864-130-0x0000000000D60000-0x0000000000DCC000-memory.dmp

Filesize
432KB

Download
memory/2864-131-0x0000000005FE0000-0x0000000006584000-memory.dmp

Filesize
5.6MB

Download
memory/4964-132-0x0000000000000000-mapping.dmp

Download
memory/4964-133-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4964-134-0x0000000000740000-0x000000000077A000-memory.dmp

Filesize
232KB

Download
memory/4964-135-0x0000000004F60000-0x0000000004FFC000-memory.dmp

Filesize
624KB

Download
memory/4964-136-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Filesize
408KB

Download
memory/4964-137-0x0000000006300000-0x0000000006350000-memory.dmp

Filesize
320KB

Download
memory/4964-138-0x0000000006870000-0x0000000006902000-memory.dmp

Filesize
584KB

Download
memory/4964-139-0x0000000006840000-0x000000000684A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads