agenttesla | 67ad8ce9502073afd22ec0e50f9180c4ef39b943d5163456b4cb2d2119287f14

General

Target

RFQ #120032020.exe
Size

436KB
MD5

21add8a8d267dd8ee406d587f4fd9aad
SHA1

f98f2159ae8ca3aa605f1e3bd52df3df97e2db3e
SHA256

023868121ca6645fc5fe59e01180a4b1bfd9e9d659fd2d93a9a122d18d7687b6
SHA512

b8fae526d9aa21adba529243bb729f193268440626104a6edbd96f15a2b31443bb8a404b9ee80b7a16e1f41365528796b3ce2fdaf94bfbd87ec880b179ffc95a

Score

10^/10

agenttesla keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.pro-powersourcing.com
Port:
587
Username:
vivi@pro-powersourcing.com
Password:
china1977

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/320-62-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/320-63-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/320-64-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/320-65-0x000000000044CE0E-mapping.dmp	family_agenttesla
behavioral1/memory/320-67-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla
behavioral1/memory/320-69-0x0000000000400000-0x0000000000452000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1744-56-0x0000000000E10000-0x0000000000E68000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ #120032020.exe

description pid process target process

PID 1744 set thread context of 320 1744 RFQ #120032020.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1536 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

320 RegSvcs.exe
320 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 320 RegSvcs.exe

description	pid	process	target process
PID 1744 set thread context of 320	1744	RFQ #120032020.exe	RegSvcs.exe

pid	process
1536	schtasks.exe

pid	process
320	RegSvcs.exe
320	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	320	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

RFQ #120032020.exe

description	pid	process	target process
PID 1744 wrote to memory of 1536	1744	RFQ #120032020.exe	schtasks.exe
PID 1744 wrote to memory of 1536	1744	RFQ #120032020.exe	schtasks.exe
PID 1744 wrote to memory of 1536	1744	RFQ #120032020.exe	schtasks.exe
PID 1744 wrote to memory of 1536	1744	RFQ #120032020.exe	schtasks.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe
PID 1744 wrote to memory of 320	1744	RFQ #120032020.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\RFQ #120032020.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ #120032020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rCWhkdR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5ACE.tmp"
2⤵
- Creates scheduled task(s)
PID:1536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5ACE.tmp
Filesize
1KB

MD5
8bab41894699655c254316c665a44782

SHA1
24c0518f107f23ebedaa5b649368b3b33513960b

SHA256
f918ba5d9ff462f3f06f3aaad35d1497b2853e835c7c04c327c6272429ab1ab0

SHA512
3234a6af21efcf166616807c0d18bbc7c1292e35aeddb13bca92ef615dc2ad232b9a347fa81e7725126b3e4ef8e7c76ecb334ec50eba48415154e4625f77d122

Download Submit
memory/320-64-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/320-59-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/320-60-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/320-62-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/320-63-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/320-65-0x000000000044CE0E-mapping.dmp

Download
memory/320-67-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/320-69-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/320-70-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1536-57-0x0000000000000000-mapping.dmp

Download
memory/1744-56-0x0000000000E10000-0x0000000000E68000-memory.dmp

Filesize
352KB

Download
memory/1744-55-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/1744-54-0x00000000012B0000-0x0000000001324000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads