agenttesla | 229082e6470957bbc79991b39d292de7465999a94311c23fc0c2c03035ae42c3

General

Target

INVOICE..exe
Size

512KB
MD5

c7b589b2c0ee8d2012007bf390786745
SHA1

b7d88731a5d9993772693715a713a15c48c33316
SHA256

229082e6470957bbc79991b39d292de7465999a94311c23fc0c2c03035ae42c3
SHA512

cc051b504a0837b5d18023361aece8b6ff5532a1f5f9a224aa587a2521ee4a4cad8e02591bd97358e79598f255e4e322066da45363af488fdd97bd00c1f15eb9

Score

10^/10

agenttesla coreentity keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
midnapore@mpjewellers.com
Password:
mpjw2013

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral2/memory/3968-6-0x0000000004BF0000-0x0000000004BF3000-memory.dmp	coreentity

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2360-9-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral2/memory/2360-10-0x000000000044AB1E-mapping.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/3968-7-0x000000000AED0000-0x000000000AF21000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

INVOICE..exe

description pid process target process

PID 3968 set thread context of 2360 3968 INVOICE..exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2360 RegSvcs.exe
2360 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

INVOICE..exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 3968 INVOICE..exe
Token: SeDebugPrivilege 2360 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

INVOICE..exeRegSvcs.exe

pid process

3968 INVOICE..exe
3968 INVOICE..exe
2360 RegSvcs.exe

description	pid	process	target process
PID 3968 set thread context of 2360	3968	INVOICE..exe	RegSvcs.exe

pid	process
2360	RegSvcs.exe
2360	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3968	INVOICE..exe
Token: SeDebugPrivilege	2360	RegSvcs.exe

pid	process
3968	INVOICE..exe
3968	INVOICE..exe
2360	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

INVOICE..exeRegSvcs.exe

description	pid	process	target process
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 3968 wrote to memory of 2360	3968	INVOICE..exe	RegSvcs.exe
PID 2360 wrote to memory of 1272	2360	RegSvcs.exe	netsh.exe
PID 2360 wrote to memory of 1272	2360	RegSvcs.exe	netsh.exe
PID 2360 wrote to memory of 1272	2360	RegSvcs.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE..exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE..exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-18-0x0000000000000000-mapping.dmp

Download
memory/2360-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2360-17-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/2360-16-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Filesize
4KB

Download
memory/2360-11-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2360-10-0x000000000044AB1E-mapping.dmp

Download
memory/3968-4-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/3968-8-0x000000000AFD0000-0x000000000AFD1000-memory.dmp

Filesize
4KB

Download
memory/3968-7-0x000000000AED0000-0x000000000AF21000-memory.dmp

Filesize
324KB

Download
memory/3968-6-0x0000000004BF0000-0x0000000004BF3000-memory.dmp

Filesize
12KB

Download
memory/3968-5-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/3968-0-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3968-3-0x0000000007BB0000-0x0000000007BB1000-memory.dmp

Filesize
4KB

Download
memory/3968-1-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads