agenttesla | 3608788a7ca7ee88aa507cc28e1a5cf3d4c49dae62ba14933085fa7197ae7841

General

Target
RFQ12ZAI_pdf.scr
Size 860KB
Sample201109-673jwe7cfe
SHA256 3608788a7ca7ee88aa507cc28e1a5cf3d4c49dae62ba14933085fa7197ae7841
MD5 1605bf6008e284245023fca26ccd4673
SHA1 17acf3f947f1c13d39a6eaeb4c7b1a84ab06ad09
SHA512 843d1c353c99747c0c61a6188dfcc7b1c68d28b7539fa9def7e8abc48e6fe2c5319c7856c1b006e6d83bacc6b5e8e1b131649992a1e511ee7ae508a9ee2cdb94
MD5 SHA1 SHA512

Score

10^/10

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

resource	yara_rule
behavioral1/memory/752-4-0x0000000000320000-0x0000000000322000-memory.dmp	coreentity

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral1/memory/752-9-0x0000000000FE0000-0x000000000102B000-memory.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

resource	yara_rule
behavioral1/memory/752-5-0x0000000001230000-0x0000000001282000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
752	RFQ12ZAI_pdf.scr
752	RFQ12ZAI_pdf.scr

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	752	RFQ12ZAI_pdf.scr

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1784	752	RFQ12ZAI_pdf.scr	27
PID 752 wrote to memory of 1784	752	RFQ12ZAI_pdf.scr	27
PID 752 wrote to memory of 1784	752	RFQ12ZAI_pdf.scr	27
PID 752 wrote to memory of 1784	752	RFQ12ZAI_pdf.scr	27
PID 752 wrote to memory of 816	752	RFQ12ZAI_pdf.scr	32
PID 752 wrote to memory of 816	752	RFQ12ZAI_pdf.scr	32
PID 752 wrote to memory of 816	752	RFQ12ZAI_pdf.scr	32
PID 752 wrote to memory of 816	752	RFQ12ZAI_pdf.scr	32

C:\Users\Admin\AppData\Local\Temp\RFQ12ZAI_pdf.scr
"C:\Users\Admin\AppData\Local\Temp\RFQ12ZAI_pdf.scr" /S
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KXyqBrloW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp232A.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1784
- C:\Windows\SysWOW64\netsh.exe
  "netsh" wlan show profile
  2⤵
  PID:816