agenttesla | 08074382bbb51534d6e743e9f948f6fa8b0e33a05598a3692dd8ec006773cc1c

General

Target

PO_UCWEB.exe
Size

800KB
MD5

df0158771e58f80c1346943b393d92f6
SHA1

7293ed7ec4181d06b0f626bd9ebdef74f5e4850a
SHA256

6cfda8d801be1dc0741573babb2b48ccec13814faf7100875d32517d12d3ea60
SHA512

f03cbb9bbc3b183564c309087f5a73cee668791bf3bd12d92d312e95fa1d3a3b3e3858c24158749921bb093edc32704b8b946c7997976c07bba80aaf1fd8c7bb

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1836-60-0x0000000004130000-0x000000000417C000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1836-57-0x0000000001F40000-0x0000000001F94000-memory.dmp	rezer0

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1776 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PO_UCWEB.exe

pid process

1836 PO_UCWEB.exe
1836 PO_UCWEB.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO_UCWEB.exe

description pid process

Token: SeDebugPrivilege 1836 PO_UCWEB.exe

pid	process
1776	schtasks.exe

pid	process
1836	PO_UCWEB.exe
1836	PO_UCWEB.exe

description	pid	process
Token: SeDebugPrivilege	1836	PO_UCWEB.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PO_UCWEB.exe

description	pid	process	target process
PID 1836 wrote to memory of 1776	1836	PO_UCWEB.exe	schtasks.exe
PID 1836 wrote to memory of 1776	1836	PO_UCWEB.exe	schtasks.exe
PID 1836 wrote to memory of 1776	1836	PO_UCWEB.exe	schtasks.exe
PID 1836 wrote to memory of 1776	1836	PO_UCWEB.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\PO_UCWEB.exe
"C:\Users\Admin\AppData\Local\Temp\PO_UCWEB.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KfuCgI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E97.tmp"
2⤵
- Creates scheduled task(s)
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3E97.tmp
Filesize
1KB

MD5
04453e8ccd87b667e1433ce6bb85bbce

SHA1
446a5f42d3f28543cbc9966b77e5d26f88cabbf6

SHA256
2e17965004a9023c04a5ffbdff6c0face715f856baa5c52e32a321031b27d55a

SHA512
5023aaae3e3445848009de3e09ff140cd7187195b6d2566e81296b3c5df58b63910dab8acc327aa5ab12d0acebb98d4fca19b7acde6e7f5fae6dffd3af49ddd7

Download Submit
memory/1776-58-0x0000000000000000-mapping.dmp

Download
memory/1836-54-0x0000000000890000-0x000000000095E000-memory.dmp

Filesize
824KB

Download
memory/1836-55-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1836-56-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/1836-57-0x0000000001F40000-0x0000000001F94000-memory.dmp

Filesize
336KB

Download
memory/1836-60-0x0000000004130000-0x000000000417C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads