agenttesla | 41ee86a60102a3221d2f8a3a1ba91567087e8f58504dcb764cc5f942af3c6a61

General

Target

catologdesign.exe
Size

441KB
MD5

ed10b06e6601040d301ed58087927a9f
SHA1

015769a2521de39c9a6f9a299ca8156c8395e187
SHA256

41ee86a60102a3221d2f8a3a1ba91567087e8f58504dcb764cc5f942af3c6a61
SHA512

e4ab8d6916c8f4dcb17a02197b7b60e40e9442132bc2385f7392a8f54c3d99170dd76c0523b0bea39673a2ca2ccc43ad80b9e8d1a52de2281ecc2f8b2fb8969f

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
webmail.saritatravels.com
Port:
587
Username:
sameerb@saritatravels.com
Password:
sameerb%$321

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3368-10-0x0000000000400000-0x000000000044A000-memory.dmp	family_agenttesla
behavioral2/memory/3368-11-0x0000000000445A5E-mapping.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/640-6-0x00000000055B0000-0x00000000055FC000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

catologdesign.exe

description pid process target process

PID 640 set thread context of 3368 640 catologdesign.exe catologdesign.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4068 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

catologdesign.exe

pid process

3368 catologdesign.exe
3368 catologdesign.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

catologdesign.exe

description pid process

Token: SeDebugPrivilege 3368 catologdesign.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

catologdesign.exe

pid process

3368 catologdesign.exe

description	pid	process	target process
PID 640 set thread context of 3368	640	catologdesign.exe	catologdesign.exe

pid	process
4068	schtasks.exe

pid	process
3368	catologdesign.exe
3368	catologdesign.exe

description	pid	process
Token: SeDebugPrivilege	3368	catologdesign.exe

pid	process
3368	catologdesign.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

catologdesign.exe

description	pid	process	target process
PID 640 wrote to memory of 4068	640	catologdesign.exe	schtasks.exe
PID 640 wrote to memory of 4068	640	catologdesign.exe	schtasks.exe
PID 640 wrote to memory of 4068	640	catologdesign.exe	schtasks.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe
PID 640 wrote to memory of 3368	640	catologdesign.exe	catologdesign.exe

C:\Users\Admin\AppData\Local\Temp\catologdesign.exe
"C:\Users\Admin\AppData\Local\Temp\catologdesign.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CZTjLVzk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp927D.tmp"
2⤵
- Creates scheduled task(s)
PID:4068

C:\Users\Admin\AppData\Local\Temp\catologdesign.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\catologdesign.exe.log
MD5
6b890abb65c85ef6929baf5d47758323

SHA1
a1b18c5edc1bbd956447975d420ffd74cf5c97ab

SHA256
d551d8c88d8d58996b962c518ed6ee72cd18124e1351d476fe88ea9ed4b2a5da

SHA512
74fa6f960c0ad7b2f14fc5b1ae5b5b706a0ac1da2509f8612c1286ffb8f5bbbf8440801d61d2e30af53210fa72ce90849ccf199a19c337791a09522e1ec907ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp927D.tmp
MD5
0f102e2d0eb4d659e7547301f3535d19

SHA1
b5d417aaf1492a3db6467ecc7c6f6e52fafe6794

SHA256
65b4885ec106ce1b7dc8370a0c418a3950e3737ef1e56636c858f028936724ba

SHA512
c9031af48058ec63090161800f47354b44c35896fb4916ab05c16db97eadb17a48c6e37e386669ad92bfec03796be36d6e573247fba9d8f354c4a0a644fd6684

Download Submit
memory/640-5-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/640-4-0x0000000002660000-0x000000000266F000-memory.dmp

Filesize
60KB

Download
memory/640-0-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/640-6-0x00000000055B0000-0x00000000055FC000-memory.dmp

Filesize
304KB

Download
memory/640-7-0x0000000005B00000-0x0000000005B01000-memory.dmp

Filesize
4KB

Download
memory/640-1-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/640-3-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3368-10-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3368-11-0x0000000000445A5E-mapping.dmp

Download
memory/3368-13-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/3368-18-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/3368-19-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

Filesize
4KB

Download
memory/3368-21-0x0000000006660000-0x0000000006661000-memory.dmp

Filesize
4KB

Download
memory/4068-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads