agenttesla | 79e9c21c5f5b430e248a3ddd739a76b97874a9057418f83416edc303e4275979

General

Target

NEW PO -060746E7.exe
Size

411KB
MD5

1ce79c86bde0daf6fcebb4f81228c118
SHA1

ff3643ac0b1626472d23a09d7b603d457e811e5c
SHA256

2b969d8cdb8ebab56e42e08200126ecf287e3ce31245f7fb8563245cc53615de
SHA512

e761e0ece89802b07894af6f5780d374192a0a1575d34d07c5acf4226c74072af8b2823f8543702de7aad3c0f646fe0f5ed7d4e50db6022267e52cb9e192ba82

Score

10^/10

agenttesla coreentity keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pptoursperu.com
Port:
587
Username:
[email protected]
Password:
mailppt2019-

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/2020-56-0x0000000000510000-0x0000000000518000-memory.dmp	coreentity

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1668-61-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1668-63-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1668-62-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1668-64-0x000000000044ABAE-mapping.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2020-57-0x00000000041C0000-0x0000000004216000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEW PO -060746E7.exe

description pid process target process

PID 2020 set thread context of 1668 2020 NEW PO -060746E7.exe RegSvcs.exe

description	pid	process	target process
PID 2020 set thread context of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

NEW PO -060746E7.exe

description	pid	process	target process
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe
PID 2020 wrote to memory of 1668	2020	NEW PO -060746E7.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\NEW PO -060746E7.exe
"C:\Users\Admin\AppData\Local\Temp\NEW PO -060746E7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-58-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1668-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1668-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1668-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1668-59-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1668-64-0x000000000044ABAE-mapping.dmp

Download
memory/2020-54-0x0000000000880000-0x00000000008EE000-memory.dmp

Filesize
440KB

Download
memory/2020-55-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download
memory/2020-56-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/2020-57-0x00000000041C0000-0x0000000004216000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads