agenttesla | 229082e6470957bbc79991b39d292de7465999a94311c23fc0c2c03035ae42c3

General

Target

INVOICE..exe
Size

512KB
MD5

c7b589b2c0ee8d2012007bf390786745
SHA1

b7d88731a5d9993772693715a713a15c48c33316
SHA256

229082e6470957bbc79991b39d292de7465999a94311c23fc0c2c03035ae42c3
SHA512

cc051b504a0837b5d18023361aece8b6ff5532a1f5f9a224aa587a2521ee4a4cad8e02591bd97358e79598f255e4e322066da45363af488fdd97bd00c1f15eb9

Score

10^/10

agenttesla coreentity keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
midnapore@mpjewellers.com
Password:
mpjw2013

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1876-4-0x0000000000770000-0x0000000000773000-memory.dmp	coreentity

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/532-6-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/532-8-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/532-7-0x000000000044AB1E-mapping.dmp	family_agenttesla
behavioral1/memory/532-9-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1876-5-0x00000000078E0000-0x0000000007931000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

INVOICE..exe

description pid process target process

PID 1876 set thread context of 532 1876 INVOICE..exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

532 RegSvcs.exe
532 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INVOICE..exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1876 INVOICE..exe
Token: SeDebugPrivilege 532 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

INVOICE..exeRegSvcs.exe

pid process

1876 INVOICE..exe
1876 INVOICE..exe
532 RegSvcs.exe

description	pid	process	target process
PID 1876 set thread context of 532	1876	INVOICE..exe	RegSvcs.exe

pid	process
532	RegSvcs.exe
532	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1876	INVOICE..exe
Token: SeDebugPrivilege	532	RegSvcs.exe

pid	process
1876	INVOICE..exe
1876	INVOICE..exe
532	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

INVOICE..exeRegSvcs.exe

description	pid	process	target process
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 1876 wrote to memory of 532	1876	INVOICE..exe	RegSvcs.exe
PID 532 wrote to memory of 1880	532	RegSvcs.exe	netsh.exe
PID 532 wrote to memory of 1880	532	RegSvcs.exe	netsh.exe
PID 532 wrote to memory of 1880	532	RegSvcs.exe	netsh.exe
PID 532 wrote to memory of 1880	532	RegSvcs.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE..exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-6-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/532-8-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/532-7-0x000000000044AB1E-mapping.dmp

Download
memory/532-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/532-10-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/1876-0-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/1876-1-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/1876-4-0x0000000000770000-0x0000000000773000-memory.dmp

Filesize
12KB

Download
memory/1876-5-0x00000000078E0000-0x0000000007931000-memory.dmp

Filesize
324KB

Download
memory/1876-13-0x0000000001F20000-0x0000000001F50000-memory.dmp

Filesize
192KB

Download
memory/1880-16-0x0000000000000000-mapping.dmp

Download
memory/2000-3-0x000007FEF7F80000-0x000007FEF81FA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads