agenttesla | 737c845c9caaab250b3298cea30af19fc6620e879c9a7aee2e7057f3300237c8

General

Target

Yeni siparis listesi11042023(.exe
Size

784KB
MD5

367fa5ab98b69b6c64db71ec19de27ee
SHA1

4d4e721640224f9598a17958fb5c4d7f294ba866
SHA256

737c845c9caaab250b3298cea30af19fc6620e879c9a7aee2e7057f3300237c8
SHA512

49b84ca151bfc602295ed0244b70fdb3a3f6702471e8dee3e206c471134ed03f779ac1b6a035d7b68adb7e774784c82d3ef637e92a40afc65e672ab88ed07a30
SSDEEP

24576:zLwUMJJa5T9GKQooPNi4/DbcR2MPKePd6:gUUkHHGNxDQR2old

Score

10^/10

agenttesla collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6120421924:AAHfDg3lTzDUW4O1CSc9eyT6zf8UpaOZqyY/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/3920-133-0x00000215CA810000-0x00000215CA8D2000-memory.dmp	net_reactor

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
11	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3920 set thread context of 1332	3920	Yeni siparis listesi11042023(.exe	87

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3920	Yeni siparis listesi11042023(.exe
3920	Yeni siparis listesi11042023(.exe
3920	Yeni siparis listesi11042023(.exe
3920	Yeni siparis listesi11042023(.exe
3920	Yeni siparis listesi11042023(.exe
3920	Yeni siparis listesi11042023(.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	Yeni siparis listesi11042023(.exe
Token: SeDebugPrivilege	1332	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1332	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 684	3920	Yeni siparis listesi11042023(.exe	84
PID 3920 wrote to memory of 684	3920	Yeni siparis listesi11042023(.exe	84
PID 3920 wrote to memory of 684	3920	Yeni siparis listesi11042023(.exe	84
PID 3920 wrote to memory of 3820	3920	Yeni siparis listesi11042023(.exe	85
PID 3920 wrote to memory of 3820	3920	Yeni siparis listesi11042023(.exe	85
PID 3920 wrote to memory of 3820	3920	Yeni siparis listesi11042023(.exe	85
PID 3920 wrote to memory of 4560	3920	Yeni siparis listesi11042023(.exe	86
PID 3920 wrote to memory of 4560	3920	Yeni siparis listesi11042023(.exe	86
PID 3920 wrote to memory of 4560	3920	Yeni siparis listesi11042023(.exe	86
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87
PID 3920 wrote to memory of 1332	3920	Yeni siparis listesi11042023(.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\Yeni siparis listesi11042023(.exe
"C:\Users\Admin\AppData\Local\Temp\Yeni siparis listesi11042023(.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:3820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  - outlook_win_path
  PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-134-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1332-136-0x0000000005F00000-0x00000000064A4000-memory.dmp

Filesize
5.6MB

Download
memory/1332-137-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/1332-138-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/1332-139-0x00000000070E0000-0x0000000007172000-memory.dmp

Filesize
584KB

Download
memory/1332-140-0x00000000070B0000-0x00000000070BA000-memory.dmp

Filesize
40KB

Download
memory/1332-141-0x0000000007370000-0x00000000073C0000-memory.dmp

Filesize
320KB

Download
memory/1332-142-0x0000000007600000-0x00000000077C2000-memory.dmp

Filesize
1.8MB

Download
memory/1332-149-0x00000000074D0000-0x000000000756C000-memory.dmp

Filesize
624KB

Download
memory/1332-150-0x0000000005A70000-0x0000000005A80000-memory.dmp

Filesize
64KB

Download
memory/3920-133-0x00000215CA810000-0x00000215CA8D2000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing