agenttesla | 696f8a6a73cfa9a84daf49781b0bd93e3a6ce36cda1330450b511706983dccb4

General

Target

804e6c9e35ced60e4f63166b0b1e6431.exe
Size

404KB
MD5

804e6c9e35ced60e4f63166b0b1e6431
SHA1

0617a7247a93933fa72cc17a369467a393847734
SHA256

696f8a6a73cfa9a84daf49781b0bd93e3a6ce36cda1330450b511706983dccb4
SHA512

0db3813f8fc5df8ed83a93ba44927e7e8134b5c30a45bcb0f3d003f92a04ebbfb81310fa79481c583a05638ce5b0ed0dead9ec9c07d71cb0ed2a4a424e26c184
SSDEEP

12288:6aOR+AzP3tHBHxFnT+VQaL95JcrzQURul5lAbUJ8EVPG:6T8ATlBRkVz9IzjR6

Score

10^/10

agenttesla collection keylogger rezer0 spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.mediszintech.com
Port:
587
Username:
[email protected]
Password:
TC!%EOL8

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3916-44-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/3916-56-0x0000000004EA0000-0x0000000004EB0000-memory.dmp	family_agenttesla

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/3184-34-0x0000000000400000-0x0000000000454000-memory.dmp	rezer0

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

804e6c9e35ced60e4f63166b0b1e6431.exe804e6c9e35ced60e4f63166b0b1e6431.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	804e6c9e35ced60e4f63166b0b1e6431.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	804e6c9e35ced60e4f63166b0b1e6431.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

804e6c9e35ced60e4f63166b0b1e6431.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	804e6c9e35ced60e4f63166b0b1e6431.exe
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	804e6c9e35ced60e4f63166b0b1e6431.exe
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	804e6c9e35ced60e4f63166b0b1e6431.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exe804e6c9e35ced60e4f63166b0b1e6431.exe

description	pid	process	target process
PID 3928 set thread context of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 set thread context of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1544 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

4084 REG.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe804e6c9e35ced60e4f63166b0b1e6431.exe

pid process

3928 powershell.exe
3928 powershell.exe
3916 804e6c9e35ced60e4f63166b0b1e6431.exe
3916 804e6c9e35ced60e4f63166b0b1e6431.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exe804e6c9e35ced60e4f63166b0b1e6431.exe

description pid process

Token: SeDebugPrivilege 3928 powershell.exe
Token: SeDebugPrivilege 3916 804e6c9e35ced60e4f63166b0b1e6431.exe

pid	process
1544	schtasks.exe

pid	process
4084	REG.exe

pid	process
3928	powershell.exe
3928	powershell.exe
3916	804e6c9e35ced60e4f63166b0b1e6431.exe
3916	804e6c9e35ced60e4f63166b0b1e6431.exe

description	pid	process
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3916	804e6c9e35ced60e4f63166b0b1e6431.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

804e6c9e35ced60e4f63166b0b1e6431.exepowershell.exe804e6c9e35ced60e4f63166b0b1e6431.exe804e6c9e35ced60e4f63166b0b1e6431.exe

description	pid	process	target process
PID 4080 wrote to memory of 3928	4080	804e6c9e35ced60e4f63166b0b1e6431.exe	powershell.exe
PID 4080 wrote to memory of 3928	4080	804e6c9e35ced60e4f63166b0b1e6431.exe	powershell.exe
PID 4080 wrote to memory of 3928	4080	804e6c9e35ced60e4f63166b0b1e6431.exe	powershell.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3928 wrote to memory of 3184	3928	powershell.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 1544	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	schtasks.exe
PID 3184 wrote to memory of 1544	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	schtasks.exe
PID 3184 wrote to memory of 1544	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	schtasks.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3184 wrote to memory of 3916	3184	804e6c9e35ced60e4f63166b0b1e6431.exe	804e6c9e35ced60e4f63166b0b1e6431.exe
PID 3916 wrote to memory of 4084	3916	804e6c9e35ced60e4f63166b0b1e6431.exe	REG.exe
PID 3916 wrote to memory of 4084	3916	804e6c9e35ced60e4f63166b0b1e6431.exe	REG.exe
PID 3916 wrote to memory of 4084	3916	804e6c9e35ced60e4f63166b0b1e6431.exe	REG.exe

outlook_office_path 1 IoCs

Processes:

804e6c9e35ced60e4f63166b0b1e6431.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	804e6c9e35ced60e4f63166b0b1e6431.exe

outlook_win_path 1 IoCs

Processes:

804e6c9e35ced60e4f63166b0b1e6431.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	804e6c9e35ced60e4f63166b0b1e6431.exe

C:\Users\Admin\AppData\Local\Temp\804e6c9e35ced60e4f63166b0b1e6431.exe
"C:\Users\Admin\AppData\Local\Temp\804e6c9e35ced60e4f63166b0b1e6431.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file "C:\Users\Public\weHtmYs.ps1"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928

C:\Users\Admin\AppData\Local\Temp\804e6c9e35ced60e4f63166b0b1e6431.exe
"{path}"
3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3184

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RULdIrTA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7956.tmp"
4⤵
- Creates scheduled task(s)
PID:1544

C:\Users\Admin\AppData\Local\Temp\804e6c9e35ced60e4f63166b0b1e6431.exe
"{path}"
4⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3916

C:\Windows\SysWOW64\REG.exe
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
5⤵
- Modifies registry key
PID:4084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\804e6c9e35ced60e4f63166b0b1e6431.exe.log
Filesize
139B

MD5
b226ddb0f6213e848e868253270d2ee4

SHA1
9d9b43c46b5a5573cd4e521293413ad9c55ef5b9

SHA256
9fcd51e732baf44df777525aca99cd16a693190659f9cab66263fd2393fb87f1

SHA512
b4f46b90bb116fffd16924b1911ab9b280c74977344788bad0db8b60818f8126efa830d282df4a97aa542d1c9ea48e445d7dd77ac33c3fda5e745787fcd74e8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s2pmyrvc.e0g.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7956.tmp
Filesize
1KB

MD5
68ac75048456c366e59cc0acdbf3fe7b

SHA1
36ecbba6fa75166e8971e26e497c742aae683ba6

SHA256
a133c6fc3666bb1701c5d57f1a21523a25544c9028d41f5d08cf7dfabaabd25e

SHA512
d483cb22fc2a07d86790f162d2c277ef9c3a5fbea659d43678dd2899a65e4eaa817d0bc2fc538f339018b9eafec19edf59e365768467d4eedf72123945387369

Download Submit
C:\Users\Public\weHtmYs.ps1
Filesize
24KB

MD5
54c60141db7cc6351f76dd7fed19a575

SHA1
5336083aee420b40d3ebb3eab56a4afd7d0fc9bc

SHA256
869f514fecc74a2444b49990f0a975c681af67b946a66c13af77d8bc14e45a11

SHA512
a34157249f6b6f462c98cd587abdb9914e50515de5953197ee15fb81bd7b57ef48aff470fee806f258f34b1e29b56f521ac3eb092d678348bcc27f3de60e0f96

Download Submit
memory/3184-34-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3184-36-0x0000000074260000-0x0000000074A10000-memory.dmp

Filesize
7.7MB

Download
memory/3184-37-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/3184-45-0x0000000074260000-0x0000000074A10000-memory.dmp

Filesize
7.7MB

Download
memory/3916-46-0x0000000074260000-0x0000000074A10000-memory.dmp

Filesize
7.7MB

Download
memory/3916-47-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3916-50-0x0000000005000000-0x0000000005018000-memory.dmp

Filesize
96KB

Download
memory/3916-55-0x0000000074260000-0x0000000074A10000-memory.dmp

Filesize
7.7MB

Download
memory/3916-44-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3916-56-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3916-57-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3916-58-0x00000000062A0000-0x00000000062AA000-memory.dmp

Filesize
40KB

Download
memory/3916-60-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3928-20-0x00000000052B0000-0x0000000005316000-memory.dmp

Filesize
408KB

Download
memory/3928-12-0x0000000005370000-0x0000000005998000-memory.dmp

Filesize
6.2MB

Download
memory/3928-32-0x00000000071F0000-0x000000000725C000-memory.dmp

Filesize
432KB

Download
memory/3928-30-0x00000000071A0000-0x00000000071A8000-memory.dmp

Filesize
32KB

Download
memory/3928-33-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/3928-28-0x00000000070E0000-0x0000000007124000-memory.dmp

Filesize
272KB

Download
memory/3928-27-0x0000000006010000-0x000000000605C000-memory.dmp

Filesize
304KB

Download
memory/3928-26-0x0000000005F60000-0x0000000005F7E000-memory.dmp

Filesize
120KB

Download
memory/3928-25-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

Filesize
3.3MB

Download
memory/3928-42-0x00000000076A0000-0x0000000007716000-memory.dmp

Filesize
472KB

Download
memory/3928-14-0x0000000005240000-0x00000000052A6000-memory.dmp

Filesize
408KB

Download
memory/3928-9-0x0000000074260000-0x0000000074A10000-memory.dmp

Filesize
7.7MB

Download
memory/3928-13-0x00000000050A0000-0x00000000050C2000-memory.dmp

Filesize
136KB

Download
memory/3928-31-0x0000000007290000-0x0000000007322000-memory.dmp

Filesize
584KB

Download
memory/3928-11-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/3928-48-0x0000000007DA0000-0x000000000841A000-memory.dmp

Filesize
6.5MB

Download
memory/3928-49-0x0000000007520000-0x000000000753A000-memory.dmp

Filesize
104KB

Download
memory/3928-8-0x0000000004BB0000-0x0000000004BE6000-memory.dmp

Filesize
216KB

Download
memory/3928-51-0x0000000074260000-0x0000000074A10000-memory.dmp

Filesize
7.7MB

Download
memory/3928-52-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/3928-54-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/3928-10-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/4080-0-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4080-5-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4080-2-0x0000000005820000-0x00000000058BC000-memory.dmp

Filesize
624KB

Download
memory/4080-1-0x0000000000D90000-0x0000000000DFC000-memory.dmp

Filesize
432KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads