agenttesla | 25904f22df6c31c8c6ad16836d00f05dc9ee66807b0d823bd62ace0485ab9e0b

Analysis

max time kernel
119s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2023, 01:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe
Size

240KB
MD5

450a4ab336664ce75f68c7834800fcb8
SHA1

981571f6e46d00bfadf9e88a1e780766c321a8ac
SHA256

16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09
SHA512

17edf46c32c8df85380fbfec7b4c5b399875b28b10b960418dcac4147b66df8457dacb3e66d046f170a5bec85c8a39ada9b6d09c133868c3b8291c1dd87165fa
SSDEEP

3072:CdA67f9xtpdnNVtf9IXSHwRRODpzfEmYFDwu5LCK+9GR:Ca67f9xtpdnNVtf9ICHwRROoFDwNKCG

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.atelierzolotas.gr
Port:
21
Username:
[email protected]
Password:
alibaba.com

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.atelierzolotas.gr
Port:
21
Username:
[email protected]
Password:
alibaba.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
25	api.ipify.org

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3484	16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe
3484	16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe

C:\Users\Admin\AppData\Local\Temp\16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe
"C:\Users\Admin\AppData\Local\Temp\16dfa584469cb9749215b87fb90e69dd2e10e2cf7c8d0a18b075e330a3b21d09.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3484-0-0x00000000004D0000-0x0000000000512000-memory.dmp

Filesize
264KB

Download
memory/3484-1-0x00000000744F0000-0x0000000074CA0000-memory.dmp

Filesize
7.7MB

Download
memory/3484-2-0x00000000054E0000-0x0000000005A84000-memory.dmp

Filesize
5.6MB

Download
memory/3484-3-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download
memory/3484-4-0x0000000004F30000-0x0000000004F96000-memory.dmp

Filesize
408KB

Download
memory/3484-5-0x00000000065A0000-0x00000000065F0000-memory.dmp

Filesize
320KB

Download
memory/3484-6-0x0000000006690000-0x000000000672C000-memory.dmp

Filesize
624KB

Download
memory/3484-7-0x00000000067D0000-0x0000000006862000-memory.dmp

Filesize
584KB

Download
memory/3484-8-0x0000000006750000-0x000000000675A000-memory.dmp

Filesize
40KB

Download
memory/3484-9-0x00000000744F0000-0x0000000074CA0000-memory.dmp

Filesize
7.7MB

Download
memory/3484-10-0x0000000004E00000-0x0000000004E10000-memory.dmp

Filesize
64KB

Download