Overview

overview

10

Static

static

DHL INVOICE.xls

windows7-x64

10

DHL INVOICE.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL INVOICE.xls

  • Size

    1.6MB

  • Sample

    221206-hrhxragf2s

  • MD5

    6082b3395c504cce2544d929326a407d

  • SHA1

    ade67d3b4c048b60f0538c6c62c6f54d58659e74

  • SHA256

    8c0b9a4b182a840e47b543ba7e9159b42d6885f20f01a08841366ed24826070e

  • SHA512

    d3af6e0a2376c337c5105c279314ec3fd25ec74603572f994a8119892099f54a89a73d51e46ab07c2e6b871024f3566e4a8b031847c4382a1a3b6e697b4c710f

  • SSDEEP

    24576:zzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDamaur5XXXXXXXXXXXXUXXXXXXXrXXXs:keY/+wFlnH

Score
10/10
agentteslacollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5466358579:AAFHSCLt1chyZSTsCVrxZSdLSPQ_50Hs-ww/

Targets

    • Target

      DHL INVOICE.xls

    • Size

      1.6MB

    • MD5

      6082b3395c504cce2544d929326a407d

    • SHA1

      ade67d3b4c048b60f0538c6c62c6f54d58659e74

    • SHA256

      8c0b9a4b182a840e47b543ba7e9159b42d6885f20f01a08841366ed24826070e

    • SHA512

      d3af6e0a2376c337c5105c279314ec3fd25ec74603572f994a8119892099f54a89a73d51e46ab07c2e6b871024f3566e4a8b031847c4382a1a3b6e697b4c710f

    • SSDEEP

      24576:zzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDamaur5XXXXXXXXXXXXUXXXXXXXrXXXs:keY/+wFlnH

    Score
    10/10
    agentteslacollectionkeyloggerspywarestealertrojan

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

      keyloggertrojanstealerspywareagenttesla

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook profiles

      collection

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Data from Local System

3
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks