agenttesla | a9ba0327f1ea8e71d77af0465dffe3038f7bc33910f908c97eab62b7bfcc404d

General

Target

New #PO 84042841.exe
Size

685KB
MD5

20187c9899f3b395219e55133004bd23
SHA1

952ca8e8eed8e2c05f7627e93ed4dad15a0fff9c
SHA256

ba6c27eedbe9c1152f8232f685600ec69ad11ada7b6e82db997e08d89a1b0385
SHA512

c8d9ab5f04c3514c207d712ec4211d41161848b1bc85dc37a4ef6b66f60ef79165ca2cb68fb965fa9e9e9ac42ab14ee7b19f05e1253815f47795f7478cecc082

Score

10^/10

agenttesla collection coreentity keylogger persistence rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sridurgaagros.com
Port:
587
Username:
patlog@sridurgaagros.com
Password:
@Hammer1980

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1972-56-0x00000000002B0000-0x00000000002B8000-memory.dmp	coreentity

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1268-63-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1268-64-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1268-65-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1268-66-0x000000000044ADAE-mapping.dmp	family_agenttesla
behavioral1/memory/1268-68-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1268-70-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1972-57-0x0000000000F30000-0x0000000000F88000-memory.dmp	rezer0

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ARevKB = "C:\\Users\\Admin\\AppData\\Roaming\\ARevKB\\ARevKB.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

New #PO 84042841.exe

description pid process target process

PID 1972 set thread context of 1268 1972 New #PO 84042841.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1488 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

New #PO 84042841.exeRegSvcs.exe

pid process

1972 New #PO 84042841.exe
1268 RegSvcs.exe
1268 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

New #PO 84042841.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1972 New #PO 84042841.exe
Token: SeDebugPrivilege 1268 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1268 RegSvcs.exe

description	pid	process	target process
PID 1972 set thread context of 1268	1972	New #PO 84042841.exe	RegSvcs.exe

pid	process
1488	schtasks.exe

pid	process
1972	New #PO 84042841.exe
1268	RegSvcs.exe
1268	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1972	New #PO 84042841.exe
Token: SeDebugPrivilege	1268	RegSvcs.exe

pid	process
1268	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

New #PO 84042841.exeRegSvcs.exe

description	pid	process	target process
PID 1972 wrote to memory of 1488	1972	New #PO 84042841.exe	schtasks.exe
PID 1972 wrote to memory of 1488	1972	New #PO 84042841.exe	schtasks.exe
PID 1972 wrote to memory of 1488	1972	New #PO 84042841.exe	schtasks.exe
PID 1972 wrote to memory of 1488	1972	New #PO 84042841.exe	schtasks.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1972 wrote to memory of 1268	1972	New #PO 84042841.exe	RegSvcs.exe
PID 1268 wrote to memory of 2044	1268	RegSvcs.exe	netsh.exe
PID 1268 wrote to memory of 2044	1268	RegSvcs.exe	netsh.exe
PID 1268 wrote to memory of 2044	1268	RegSvcs.exe	netsh.exe
PID 1268 wrote to memory of 2044	1268	RegSvcs.exe	netsh.exe

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\New #PO 84042841.exe
"C:\Users\Admin\AppData\Local\Temp\New #PO 84042841.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LGLnPADnHxaOpi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1739.tmp"
2⤵
- Creates scheduled task(s)
PID:1488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Drops file in Drivers directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1268

C:\Windows\SysWOW64\netsh.exe
"netsh" wlan show profile
3⤵
PID:2044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1739.tmp
Filesize
1KB

MD5
9182baf86f24ae5d65f9b50e7312563b

SHA1
cb3ff52b49bddd61e167ea7d6cf331a89a85ab28

SHA256
2130cbd6bb08760477313b56c7b8dab52c7a5fb7c0b570c784ddee6125198b25

SHA512
9487b080fea4dc633e4504f4874bcb42f35f67cfa5b2acff9afed04ee61b671a450c2d8f4f75fe20eab2f9a073d45088738c4eddea51fa01d70311f8b88ba7eb

Download Submit
memory/1268-64-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1268-66-0x000000000044ADAE-mapping.dmp

Download
memory/1268-70-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1268-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1268-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1268-60-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1268-61-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1268-63-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1488-58-0x0000000000000000-mapping.dmp

Download
memory/1972-54-0x0000000000FD0000-0x0000000001080000-memory.dmp

Filesize
704KB

Download
memory/1972-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/1972-57-0x0000000000F30000-0x0000000000F88000-memory.dmp

Filesize
352KB

Download
memory/2044-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads