agenttesla | a767a3b413dfbbbc5fe2c59ecccfcddeb457f4cc7aff68ef1502b69bb75e46de

General

Target
TT COPY.exe
Size 561KB
Sample201109-twlpl1drfx
SHA256 a767a3b413dfbbbc5fe2c59ecccfcddeb457f4cc7aff68ef1502b69bb75e46de
MD5 39a24fcf8e2a2bd712643326b7d95b8c
SHA1 4354da2df4f793deddd0cb9d3483a4c87257aacf
SHA512 16ecb9ff555e5fa534e4f3dba53e04b8dff3194303cf67a8560fe1c032acf899aac0e70271625ad11295df01d220ae12e41f97188b262410ad95c8aa98aac772
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
mpjw2013

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2380-9-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral2/memory/2380-10-0x000000000044AB1E-mapping.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral2/memory/3980-7-0x000000000B940000-0x000000000B991000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3980 set thread context of 2380	3980	TT COPY.exe	76

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2380	RegSvcs.exe
2380	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2380	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 3980 wrote to memory of 2380	3980	TT COPY.exe	76
PID 2380 wrote to memory of 1316	2380	RegSvcs.exe	80
PID 2380 wrote to memory of 1316	2380	RegSvcs.exe	80
PID 2380 wrote to memory of 1316	2380	RegSvcs.exe	80

C:\Users\Admin\AppData\Local\Temp\TT COPY.exe
"C:\Users\Admin\AppData\Local\Temp\TT COPY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profile
    3⤵
    PID:1316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-9-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/2380-17-0x0000000005F80000-0x0000000005F81000-memory.dmp

Download

memory/2380-16-0x0000000005480000-0x0000000005481000-memory.dmp

Download

memory/2380-11-0x0000000073A20000-0x000000007410E000-memory.dmp

Download

memory/3980-4-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Download

memory/3980-8-0x000000000BA50000-0x000000000BA51000-memory.dmp

Download

memory/3980-7-0x000000000B940000-0x000000000B991000-memory.dmp

Download

memory/3980-6-0x000000000A050000-0x000000000A052000-memory.dmp

Download

memory/3980-5-0x0000000007D90000-0x0000000007D91000-memory.dmp

Download

memory/3980-0-0x0000000073A20000-0x000000007410E000-memory.dmp

Download

memory/3980-3-0x0000000008220000-0x0000000008221000-memory.dmp

Download

memory/3980-1-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads