agenttesla | d1e37596ea3c5d8be494019288581d66277678d424ac8525f56fdf1b6f3c3c82

Analysis

max time kernel
71s
max time network
78s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-09-2022 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL Paper work for new delivery pending.exe
Size

300.0MB
MD5

8c35866b025f430aa414b26a4c89c83e
SHA1

543ec275daf8ae6aaa269001c3c55a5094db4d94
SHA256

91c525cb0f58e54d045b4f37e35077df803ac7116a82a43c65427387e545185d
SHA512

cbb76e6de793ef680d2b22527e06cacc57ef1351a8c7d0995e11933e39fbfc8d1c60251eef371f93fecf3258c5aacdd47ef6a00af3f8cb0be0059cd9da418c51
SSDEEP

6144:BScGd7kbUdT6a5f4KRTvyMMzj6XZ9S7+5:EZ7RN6kf48GHm90+5

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot5279095555:AAE4HwAzPbUle9whPqEu6faWeNRU-6BRHps/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 2020	1412	DHL Paper work for new delivery pending.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2020	vbc.exe
2020	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2020	vbc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27
PID 1412 wrote to memory of 2020	1412	DHL Paper work for new delivery pending.exe	27

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Users\Admin\AppData\Local\Temp\DHL Paper work for new delivery pending.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Paper work for new delivery pending.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-54-0x00000000010A0000-0x00000000010E0000-memory.dmp

Filesize
256KB

Download
memory/2020-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2020-56-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2020-58-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2020-59-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2020-60-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2020-63-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2020-65-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2020-66-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download