agenttesla | 33708f02e31c62d1b986589982e4e1c4f381089b67276d395a0e74c995a1e822

General

Target

DOCUMENTS.exe
Size

459KB
MD5

ab454b4f47b4848029dcc17081b020e5
SHA1

455a51a8baaf8e200ad26868763d616bcba760de
SHA256

33708f02e31c62d1b986589982e4e1c4f381089b67276d395a0e74c995a1e822
SHA512

e9f254a2ed7835a0b83553caab55347d99f51d7aeb4ee54fcfdc8dafc89a47feec9eb663d008f9ba40ee01b2e8f97c529cac3be4f282d863db07968a5f236a4a

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
midnapore@mpjewellers.com
Password:
mpjw2013

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2624-9-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral2/memory/2624-10-0x000000000044AB1E-mapping.dmp	family_agenttesla

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/732-8-0x000000000A560000-0x000000000A5B1000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

DOCUMENTS.exe

description pid process target process

PID 732 set thread context of 2624 732 DOCUMENTS.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

DOCUMENTS.exeRegSvcs.exe

pid process

732 DOCUMENTS.exe
732 DOCUMENTS.exe
732 DOCUMENTS.exe
732 DOCUMENTS.exe
2624 RegSvcs.exe
2624 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

DOCUMENTS.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 732 DOCUMENTS.exe
Token: SeDebugPrivilege 2624 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

2624 RegSvcs.exe

description	pid	process	target process
PID 732 set thread context of 2624	732	DOCUMENTS.exe	RegSvcs.exe

pid	process
732	DOCUMENTS.exe
732	DOCUMENTS.exe
732	DOCUMENTS.exe
732	DOCUMENTS.exe
2624	RegSvcs.exe
2624	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	732	DOCUMENTS.exe
Token: SeDebugPrivilege	2624	RegSvcs.exe

pid	process
2624	RegSvcs.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

DOCUMENTS.exeRegSvcs.exe

description	pid	process	target process
PID 732 wrote to memory of 632	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 632	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 632	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 3920	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 3920	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 3920	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 732 wrote to memory of 2624	732	DOCUMENTS.exe	RegSvcs.exe
PID 2624 wrote to memory of 3856	2624	RegSvcs.exe	netsh.exe
PID 2624 wrote to memory of 3856	2624	RegSvcs.exe	netsh.exe
PID 2624 wrote to memory of 3856	2624	RegSvcs.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENTS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:3920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:3856

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-0-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/732-1-0x0000000000040000-0x0000000000041000-memory.dmp

Filesize
4KB

Download
memory/732-3-0x00000000072A0000-0x00000000072A1000-memory.dmp

Filesize
4KB

Download
memory/732-4-0x0000000006E40000-0x0000000006E41000-memory.dmp

Filesize
4KB

Download
memory/732-5-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/732-6-0x00000000043A0000-0x00000000043A3000-memory.dmp

Filesize
12KB

Download
memory/732-7-0x000000000A440000-0x000000000A441000-memory.dmp

Filesize
4KB

Download
memory/732-8-0x000000000A560000-0x000000000A5B1000-memory.dmp

Filesize
324KB

Download
memory/2624-9-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2624-10-0x000000000044AB1E-mapping.dmp

Download
memory/2624-11-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Filesize
6.9MB

Download
memory/2624-16-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/2624-17-0x00000000063A0000-0x00000000063A1000-memory.dmp

Filesize
4KB

Download
memory/3856-18-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads