agenttesla | 88502fda993fde73909371ca6813191b0af2d571632c1ebd5c92bd3a844af1c9

General

Target

Doc.exe
Size

478KB
MD5

bf08620d6295f47bdde72569b43677ca
SHA1

2afe1a20b5cd9255ac5429aaf7b7df3849f9c578
SHA256

88502fda993fde73909371ca6813191b0af2d571632c1ebd5c92bd3a844af1c9
SHA512

8b56773ffc23603b18f9c549291a6fa3010f17d33fdad55039eeb81b393cd8d9b8251ccc1e4148e54f879980bc1ef80ee75bcbf99abc7af7c4034827cc6fbb6e

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.kalatecnic.com
Port:
587
Username:
comercial@kalatecnic.com
Password:
Barcelona08397

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2064-10-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral2/memory/2064-11-0x000000000044CDCE-mapping.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/3988-6-0x0000000005B40000-0x0000000005B93000-memory.dmp	rezer0

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Doc.exe

description pid process target process

PID 3988 set thread context of 2064 3988 Doc.exe Doc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1288 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Doc.exe

pid process

2064 Doc.exe
2064 Doc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Doc.exe

description pid process

Token: SeDebugPrivilege 2064 Doc.exe

description	pid	process	target process
PID 3988 set thread context of 2064	3988	Doc.exe	Doc.exe

pid	process
1288	schtasks.exe

pid	process
2064	Doc.exe
2064	Doc.exe

description	pid	process
Token: SeDebugPrivilege	2064	Doc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Doc.exeDoc.exe

description	pid	process	target process
PID 3988 wrote to memory of 1288	3988	Doc.exe	schtasks.exe
PID 3988 wrote to memory of 1288	3988	Doc.exe	schtasks.exe
PID 3988 wrote to memory of 1288	3988	Doc.exe	schtasks.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 3988 wrote to memory of 2064	3988	Doc.exe	Doc.exe
PID 2064 wrote to memory of 3508	2064	Doc.exe	netsh.exe
PID 2064 wrote to memory of 3508	2064	Doc.exe	netsh.exe
PID 2064 wrote to memory of 3508	2064	Doc.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Doc.exe
"C:\Users\Admin\AppData\Local\Temp\Doc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\chjgYQTVsGlXd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp754.tmp"
2⤵
- Creates scheduled task(s)
PID:1288

C:\Users\Admin\AppData\Local\Temp\Doc.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:3508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Doc.exe.log
MD5
6b890abb65c85ef6929baf5d47758323

SHA1
a1b18c5edc1bbd956447975d420ffd74cf5c97ab

SHA256
d551d8c88d8d58996b962c518ed6ee72cd18124e1351d476fe88ea9ed4b2a5da

SHA512
74fa6f960c0ad7b2f14fc5b1ae5b5b706a0ac1da2509f8612c1286ffb8f5bbbf8440801d61d2e30af53210fa72ce90849ccf199a19c337791a09522e1ec907ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp754.tmp
MD5
41abdfc53317aa13e28015f00aef3a36

SHA1
936b5c8971106b88729d28807f7d4591d9c427d8

SHA256
24f4cddadeaa041f5740b8b3badd5efda411074e1af48fd8ce022627132cff18

SHA512
8feaa1c57d5c28f826823517ae98fbf2a86134887d72fb08467990ce127135c7e7b888d330d5598f3c0f625e45ac2589bc6df042a91f63689ccf1a29c8c72a2a

Download Submit
memory/1288-8-0x0000000000000000-mapping.dmp

Download
memory/2064-13-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2064-18-0x0000000005A40000-0x0000000005A41000-memory.dmp

Filesize
4KB

Download
memory/2064-22-0x0000000006CE0000-0x0000000006CE1000-memory.dmp

Filesize
4KB

Download
memory/2064-19-0x0000000006500000-0x0000000006501000-memory.dmp

Filesize
4KB

Download
memory/2064-11-0x000000000044CDCE-mapping.dmp

Download
memory/2064-10-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3508-20-0x0000000000000000-mapping.dmp

Download
memory/3988-3-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/3988-4-0x00000000015E0000-0x00000000015EF000-memory.dmp

Filesize
60KB

Download
memory/3988-1-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/3988-0-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/3988-5-0x00000000058A0000-0x00000000058A1000-memory.dmp

Filesize
4KB

Download
memory/3988-7-0x00000000061E0000-0x00000000061E1000-memory.dmp

Filesize
4KB

Download
memory/3988-6-0x0000000005B40000-0x0000000005B93000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads