agenttesla | f638b6b5261b1bca1368c299b7b7017360192e19058da4f5079cfb342d0afb63

General

Target

EFS_SPEC.exe
Size

845KB
MD5

d51d2bf57db9ce6c54521c328dd5fb28
SHA1

674964135e6b5d1a766240ebd0340a4db0064218
SHA256

cd9b154f848a6f37a110de136034cbf5190600da5687bb6259f19addf2e2759a
SHA512

04be3bb5ae07685b17394c3a322bde994900670b60983e7ead30dbfd7bc9cfec42b81d6c85890be52e618aa74afafc172dbbbfe19b01cc1cd6a4005907825dda

Score

10^/10

agenttesla evasion keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
business43.web-hosting.com
Port:
587
Username:
[email protected]
Password:
P04042017

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1008-66-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1008-67-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1008-68-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1008-69-0x000000000044C81E-mapping.dmp	family_agenttesla
behavioral1/memory/1008-71-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/1008-73-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1728-57-0x0000000004C30000-0x0000000004C8A000-memory.dmp	rezer0

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

EFS_SPEC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	EFS_SPEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	EFS_SPEC.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

EFS_SPEC.exe

description pid process target process

PID 1728 set thread context of 1008 1728 EFS_SPEC.exe EFS_SPEC.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

688 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

EFS_SPEC.exepowershell.exeEFS_SPEC.exe

pid process

1728 EFS_SPEC.exe
1728 EFS_SPEC.exe
1792 powershell.exe
1008 EFS_SPEC.exe
1008 EFS_SPEC.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

EFS_SPEC.exepowershell.exeEFS_SPEC.exe

description pid process

Token: SeDebugPrivilege 1728 EFS_SPEC.exe
Token: SeDebugPrivilege 1792 powershell.exe
Token: SeDebugPrivilege 1008 EFS_SPEC.exe

description	pid	process	target process
PID 1728 set thread context of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe

pid	process
688	schtasks.exe

pid	process
1728	EFS_SPEC.exe
1728	EFS_SPEC.exe
1792	powershell.exe
1008	EFS_SPEC.exe
1008	EFS_SPEC.exe

description	pid	process
Token: SeDebugPrivilege	1728	EFS_SPEC.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	1008	EFS_SPEC.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

EFS_SPEC.exe

description	pid	process	target process
PID 1728 wrote to memory of 1792	1728	EFS_SPEC.exe	powershell.exe
PID 1728 wrote to memory of 1792	1728	EFS_SPEC.exe	powershell.exe
PID 1728 wrote to memory of 1792	1728	EFS_SPEC.exe	powershell.exe
PID 1728 wrote to memory of 1792	1728	EFS_SPEC.exe	powershell.exe
PID 1728 wrote to memory of 688	1728	EFS_SPEC.exe	schtasks.exe
PID 1728 wrote to memory of 688	1728	EFS_SPEC.exe	schtasks.exe
PID 1728 wrote to memory of 688	1728	EFS_SPEC.exe	schtasks.exe
PID 1728 wrote to memory of 688	1728	EFS_SPEC.exe	schtasks.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe
PID 1728 wrote to memory of 1008	1728	EFS_SPEC.exe	EFS_SPEC.exe

C:\Users\Admin\AppData\Local\Temp\EFS_SPEC.exe
"C:\Users\Admin\AppData\Local\Temp\EFS_SPEC.exe"
1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eIQPiUga" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2962.tmp"
2⤵
- Creates scheduled task(s)
PID:688

C:\Users\Admin\AppData\Local\Temp\EFS_SPEC.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2962.tmp

Filesize
1KB

MD5
47a0ec7e1739e4afd9719f2f2f85e87b

SHA1
1fed624665ad3f2094cf5c48787f2f10b0e60bf2

SHA256
0ae5b643aa9b06ae906e1836eaa152598d3aba5521eae40b33c02c4578327487

SHA512
fa71322bca7724876f8edb450992954d6cc8e06b7030fe18fe110a9a560f7fac53ce8cbb4ef530da19dd161ea95c12fa081f554f5fde805c06d9b9eb4d437f52

Download Submit
memory/688-61-0x0000000000000000-mapping.dmp

Download
memory/1008-67-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1008-64-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1008-73-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1008-71-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1008-69-0x000000000044C81E-mapping.dmp

Download
memory/1008-68-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1008-66-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1008-63-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1728-54-0x0000000000AF0000-0x0000000000BCA000-memory.dmp

Filesize
872KB

Download
memory/1728-55-0x00000000003A0000-0x00000000003FE000-memory.dmp

Filesize
376KB

Download
memory/1728-57-0x0000000004C30000-0x0000000004C8A000-memory.dmp

Filesize
360KB

Download
memory/1728-56-0x0000000000380000-0x0000000000388000-memory.dmp

Filesize
32KB

Download
memory/1792-60-0x000000006F660000-0x000000006FC0B000-memory.dmp

Filesize
5.7MB

Download
memory/1792-59-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1792-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads