agenttesla | d5819b520b3e566b31f7aaf830c521264b8b3bf66b7d85c729537d138e042b81

General

Target

PO-055MAY.exe
Size

651KB
MD5

4764f309bdf491747a14f235ffb64dcb
SHA1

41d7678b2da67f53fd00991cfa386cc84de0b1ce
SHA256

d5819b520b3e566b31f7aaf830c521264b8b3bf66b7d85c729537d138e042b81
SHA512

c3ad68790d04b263379ee3702bcc85320367cc604abc70755bf7cdc91e58c1831ab5e89b043bfefcf0e1584c7e47baf6d5ca0f4acda98378bb27c0b128135795

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
webmail.basefirms.name
Port:
587
Username:
info@basefirms.name
Password:
Michael126411790

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/752-16-0x000000000044A9AE-mapping.dmp	family_agenttesla
behavioral2/memory/752-15-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/4704-14-0x00000000079A0000-0x00000000079F1000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO-055MAY.exe

description pid process target process

PID 4704 set thread context of 752 4704 PO-055MAY.exe PO-055MAY.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PO-055MAY.exePO-055MAY.exe

pid process

4704 PO-055MAY.exe
4704 PO-055MAY.exe
4704 PO-055MAY.exe
4704 PO-055MAY.exe
752 PO-055MAY.exe
752 PO-055MAY.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO-055MAY.exePO-055MAY.exe

description pid process

Token: SeDebugPrivilege 4704 PO-055MAY.exe
Token: SeDebugPrivilege 752 PO-055MAY.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

PO-055MAY.exe

pid process

752 PO-055MAY.exe

description	pid	process	target process
PID 4704 set thread context of 752	4704	PO-055MAY.exe	PO-055MAY.exe

pid	process
4704	PO-055MAY.exe
4704	PO-055MAY.exe
4704	PO-055MAY.exe
4704	PO-055MAY.exe
752	PO-055MAY.exe
752	PO-055MAY.exe

description	pid	process
Token: SeDebugPrivilege	4704	PO-055MAY.exe
Token: SeDebugPrivilege	752	PO-055MAY.exe

pid	process
752	PO-055MAY.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PO-055MAY.exe

description	pid	process	target process
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe
PID 4704 wrote to memory of 752	4704	PO-055MAY.exe	PO-055MAY.exe

C:\Users\Admin\AppData\Local\Temp\PO-055MAY.exe
"C:\Users\Admin\AppData\Local\Temp\PO-055MAY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

C:\Users\Admin\AppData\Local\Temp\PO-055MAY.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO-055MAY.exe.log
MD5
b4f7a6a57cb46d94b72410eb6a6d45a9

SHA1
69f3596ffa027202d391444b769ceea0ae14c5f7

SHA256
23994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b

SHA512
be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c

Download Submit
memory/752-16-0x000000000044A9AE-mapping.dmp

Download
memory/752-24-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/752-23-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/752-18-0x0000000073530000-0x0000000073C1E000-memory.dmp

Filesize
6.9MB

Download
memory/752-15-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4704-5-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

Filesize
4KB

Download
memory/4704-10-0x0000000005EA0000-0x0000000005EA3000-memory.dmp

Filesize
12KB

Download
memory/4704-11-0x0000000009490000-0x0000000009491000-memory.dmp

Filesize
4KB

Download
memory/4704-14-0x00000000079A0000-0x00000000079F1000-memory.dmp

Filesize
324KB

Download
memory/4704-9-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/4704-8-0x0000000005C10000-0x0000000005C20000-memory.dmp

Filesize
64KB

Download
memory/4704-0-0x0000000073530000-0x0000000073C1E000-memory.dmp

Filesize
6.9MB

Download
memory/4704-4-0x0000000006010000-0x0000000006011000-memory.dmp

Filesize
4KB

Download
memory/4704-3-0x0000000005970000-0x00000000059CB000-memory.dmp

Filesize
364KB

Download
memory/4704-1-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads