agenttesla | 3e126eedc02526ba804d9351d6d9b1a6da2114510f98b4235662ab6fdb024bbf

General

Target

5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
Size

642KB
MD5

5aa6dbe2ea7acf2d2d09c9a7aa95c74d
SHA1

400a222a2061648f048c256ba19c0a5f4978b8ea
SHA256

3e126eedc02526ba804d9351d6d9b1a6da2114510f98b4235662ab6fdb024bbf
SHA512

6c3ea0957d50e4f39177fe9098c997587bf2b1d1886e2c2168e2e663505d63b9cb61162c7bb2ebe2ae42a09aff75857001eb22ae46231174db8f34515674e957

Score

10^/10

agenttesla coreentity keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
emiliobianchi@yandex.com
Password:
hardwork17

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
emiliobianchi@yandex.com
Password:
hardwork17

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral2/memory/504-7-0x000000000A580000-0x000000000A582000-memory.dmp	coreentity

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1264-12-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/1264-13-0x000000000044C3EE-mapping.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/504-8-0x000000000D830000-0x000000000D882000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

description pid process target process

PID 504 set thread context of 1264 504 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

188 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

pid process

504 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
1264 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
1264 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

description pid process

Token: SeDebugPrivilege 504 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
Token: SeDebugPrivilege 1264 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

pid process

1264 5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

description	pid	process	target process
PID 504 set thread context of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

pid	process
188	schtasks.exe

pid	process
504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
1264	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
1264	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

description	pid	process
Token: SeDebugPrivilege	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
Token: SeDebugPrivilege	1264	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

pid	process
1264	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe

description	pid	process	target process
PID 504 wrote to memory of 188	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	schtasks.exe
PID 504 wrote to memory of 188	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	schtasks.exe
PID 504 wrote to memory of 188	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	schtasks.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 504 wrote to memory of 1264	504	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
PID 1264 wrote to memory of 1436	1264	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	netsh.exe
PID 1264 wrote to memory of 1436	1264	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	netsh.exe
PID 1264 wrote to memory of 1436	1264	5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
"C:\Users\Admin\AppData\Local\Temp\5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:504

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\huqLmghXfAwL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp425E.tmp"
2⤵
- Creates scheduled task(s)
PID:188

C:\Users\Admin\AppData\Local\Temp\5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:1436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5aa6dbe2ea7acf2d2d09c9a7aa95c74d.exe.log
MD5
b4f7a6a57cb46d94b72410eb6a6d45a9

SHA1
69f3596ffa027202d391444b769ceea0ae14c5f7

SHA256
23994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b

SHA512
be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp425E.tmp
MD5
49f31bf5cf76c13f96117fdad2471673

SHA1
1eab0e420a233cd8f796e129902f4ae6a343f148

SHA256
f2b6116b1c6a396f7c49ed6d108d7bec8afe51c455f0576c83ae03d406ceb820

SHA512
8f65a48628d7c4863a02e537d47f82728350b3f7f1deb0806ec1587e859801b15985a17359d10e90434f937d607eef8ab3e24b3ecfe3d81e70ab781a26095c0a

Download Submit
memory/188-10-0x0000000000000000-mapping.dmp

Download
memory/504-9-0x000000000D940000-0x000000000D941000-memory.dmp

Filesize
4KB

Download
memory/504-3-0x0000000004BC0000-0x0000000004C2F000-memory.dmp

Filesize
444KB

Download
memory/504-6-0x000000000A3A0000-0x000000000A3A1000-memory.dmp

Filesize
4KB

Download
memory/504-7-0x000000000A580000-0x000000000A582000-memory.dmp

Filesize
8KB

Download
memory/504-8-0x000000000D830000-0x000000000D882000-memory.dmp

Filesize
328KB

Download
memory/504-0-0x0000000073920000-0x000000007400E000-memory.dmp

Filesize
6.9MB

Download
memory/504-4-0x000000000A6F0000-0x000000000A6F1000-memory.dmp

Filesize
4KB

Download
memory/504-5-0x000000000A230000-0x000000000A231000-memory.dmp

Filesize
4KB

Download
memory/504-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1264-13-0x000000000044C3EE-mapping.dmp

Download
memory/1264-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1264-15-0x0000000073920000-0x000000007400E000-memory.dmp

Filesize
6.9MB

Download
memory/1264-20-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/1264-21-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/1436-22-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads