ago.exe

General
Target

ago.exe

Filesize

216KB

Completed

22-11-2020 00:07

Score
7 /10
MD5

8a22b57fee81a6691ba74ce13ea58f95

SHA1

e53b9783088fda62bcd087478eee6658097858c0

SHA256

c0854444ad8bd79257dd667fb86b4e395921c709bc00a1e43691219339a546d1

Malware Config
Signatures 6

Filter: none

Collection
Credential Access
  • Reads data files stored by FTP clients

    Description

    Tries to access configuration files associated with programs like FileZilla.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of local email clients

    Description

    Email clients store some user data on disk where infostealers will often target it.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    15api.ipify.org
    16api.ipify.org
  • Suspicious behavior: EnumeratesProcesses
    ago.exe

    Reported IOCs

    pidprocess
    424ago.exe
    424ago.exe
  • Suspicious use of AdjustPrivilegeToken
    ago.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege424ago.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\ago.exe
    "C:\Users\Admin\AppData\Local\Temp\ago.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:424
Network
MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads

                      • memory/424-0-0x0000000073D50000-0x000000007443E000-memory.dmp

                        Download

                      • memory/424-1-0x0000000000920000-0x0000000000921000-memory.dmp

                        Download

                      • memory/424-3-0x0000000005770000-0x0000000005771000-memory.dmp

                        Download

                      • memory/424-4-0x0000000005310000-0x0000000005311000-memory.dmp

                        Download

                      • memory/424-5-0x00000000056B0000-0x00000000056B1000-memory.dmp

                        Download

                      • memory/424-6-0x0000000005E60000-0x0000000005E61000-memory.dmp

                        Download

                      • memory/424-7-0x00000000069D0000-0x00000000069D1000-memory.dmp

                        Download

                      • memory/424-8-0x00000000010C0000-0x00000000010C1000-memory.dmp

                        Download