agenttesla | 27d3d5fe5fba171eb2244f07692441be38c7308507b446977a377bff17bb5904

General

Target

DHL Original Documents.exe
Size

1.5MB
MD5

37db5181e973d4d7f9c44ff2a2b80f01
SHA1

1e4d62ddeb63fb6402efa812c59ab3a787282d6f
SHA256

27d3d5fe5fba171eb2244f07692441be38c7308507b446977a377bff17bb5904
SHA512

2bad9e74c49d5715b5438c0facaa81493c167f3b311c9a1f1ce7d8f0ea70d1f09d0e49ebfa56cf220bc5bb4546f050875e0bb8e76bd680e226b74480835ec7a9
SSDEEP

24576:+fFQddjdaB8OWqN0ujXGEJUuLp2avBh4kUaOY7zEGOmth0tgo5fnv/:+tiG8OjqujXx/LgavBSkUI7yuh0tgk/

Score

10^/10

agenttesla rhadamanthys collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.aficofilters.com.eg
Port:
587
Username:
[email protected]
Password:
mhds@852
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect rhadamanthys stealer shellcode 3 IoCs

resource	yara_rule
behavioral2/memory/1564-154-0x0000000002B40000-0x0000000002B5C000-memory.dmp	family_rhadamanthys
behavioral2/memory/1564-155-0x0000000002CC0000-0x0000000003CC0000-memory.dmp	family_rhadamanthys
behavioral2/memory/1564-158-0x0000000002B40000-0x0000000002B5C000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2940 created 2932	2940	DHL Original Documents.exe	18

Loads dropped DLL 1 IoCs

pid	Process
2940	DHL Original Documents.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ngentask.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ngentask.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ngentask.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1564	fontview.exe
1564	fontview.exe
1564	fontview.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 4772	2940	DHL Original Documents.exe	82

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4792	2940	WerFault.exe	80
1424	2940	WerFault.exe	80

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	fontview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	fontview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fontview.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe
2940	DHL Original Documents.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	ngentask.exe
Token: SeShutdownPrivilege	1564	fontview.exe
Token: SeCreatePagefilePrivilege	1564	fontview.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 5000	2940	DHL Original Documents.exe	81
PID 2940 wrote to memory of 5000	2940	DHL Original Documents.exe	81
PID 2940 wrote to memory of 5000	2940	DHL Original Documents.exe	81
PID 2940 wrote to memory of 4772	2940	DHL Original Documents.exe	82
PID 2940 wrote to memory of 4772	2940	DHL Original Documents.exe	82
PID 2940 wrote to memory of 4772	2940	DHL Original Documents.exe	82
PID 2940 wrote to memory of 4772	2940	DHL Original Documents.exe	82
PID 2940 wrote to memory of 4772	2940	DHL Original Documents.exe	82
PID 2940 wrote to memory of 1564	2940	DHL Original Documents.exe	83
PID 2940 wrote to memory of 1564	2940	DHL Original Documents.exe	83
PID 2940 wrote to memory of 1564	2940	DHL Original Documents.exe	83
PID 2940 wrote to memory of 1564	2940	DHL Original Documents.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ngentask.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ngentask.exe

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2932
- C:\Windows\SysWOW64\fontview.exe
  "C:\Windows\SYSWOW64\fontview.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:1564

C:\Users\Admin\AppData\Local\Temp\DHL Original Documents.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Original Documents.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
  2⤵
  PID:5000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 400
  2⤵
  - Program crash
  PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 496
  2⤵
  - Program crash
  PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2940 -ip 2940
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2940 -ip 2940
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240575765.dll

Filesize
334KB

MD5
a776349b1a3713ff5c8251d950f99b09

SHA1
a893a50ac7dfbf94a06433495cabd38753ddc427

SHA256
832ff3d9aca75fa41ee25c3563df83c21e8839058351c9154893c450c97adb61

SHA512
47a837d891cfd600865deb328277a56f2eb53c082162e3b549f9e2da922da249fa31e3e5fc15846ab218455e67416a4d61a29a19e63fb1dcdce04b65450d1a2c

Download Submit
memory/1564-156-0x0000000000DA0000-0x0000000000DD3000-memory.dmp

Filesize
204KB

Download
memory/1564-154-0x0000000002B40000-0x0000000002B5C000-memory.dmp

Filesize
112KB

Download
memory/1564-158-0x0000000002B40000-0x0000000002B5C000-memory.dmp

Filesize
112KB

Download
memory/1564-157-0x0000000001118000-0x0000000001132000-memory.dmp

Filesize
104KB

Download
memory/1564-148-0x0000000000DA0000-0x0000000000DD3000-memory.dmp

Filesize
204KB

Download
memory/1564-145-0x0000000000DA0000-0x0000000000DD3000-memory.dmp

Filesize
204KB

Download
memory/1564-155-0x0000000002CC0000-0x0000000003CC0000-memory.dmp

Filesize
16.0MB

Download
memory/1564-142-0x0000000000DA0000-0x0000000000DD3000-memory.dmp

Filesize
204KB

Download
memory/1564-153-0x0000000001118000-0x0000000001132000-memory.dmp

Filesize
104KB

Download
memory/2940-133-0x0000000000C05000-0x0000000000D5D000-memory.dmp

Filesize
1.3MB

Download
memory/2940-134-0x000000000E0D0000-0x000000000E292000-memory.dmp

Filesize
1.8MB

Download
memory/2940-146-0x0000000000C05000-0x0000000000D5D000-memory.dmp

Filesize
1.3MB

Download
memory/2940-147-0x000000000E0D0000-0x000000000E292000-memory.dmp

Filesize
1.8MB

Download
memory/2940-132-0x000000000E0D0000-0x000000000E292000-memory.dmp

Filesize
1.8MB

Download
memory/2940-159-0x0000000000C05000-0x0000000000D5D000-memory.dmp

Filesize
1.3MB

Download
memory/4772-139-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4772-151-0x0000000006D60000-0x0000000006DB0000-memory.dmp

Filesize
320KB

Download
memory/4772-152-0x0000000006F80000-0x0000000007142000-memory.dmp

Filesize
1.8MB

Download
memory/4772-150-0x0000000006B60000-0x0000000006B6A000-memory.dmp

Filesize
40KB

Download
memory/4772-149-0x0000000006B70000-0x0000000006C02000-memory.dmp

Filesize
584KB

Download
memory/4772-144-0x0000000005480000-0x00000000054E6000-memory.dmp

Filesize
408KB

Download
memory/4772-141-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Filesize
5.6MB

Download
memory/4772-137-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing