agenttesla | 3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39

General

Target

3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
Size

835KB
MD5

47768ce0f6e578743e3ffcd1cdc45a85
SHA1

359276e0825600dd637166ae75315cfaf60585a0
SHA256

3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39
SHA512

cdf1f850f15e0addb7873be7bd5ed3cf8e32d1164e5aa7a584fac227b223a0dfd4b8798e92da29ceadfd838ae37e6599b975c7cbc76034053f3d88db88bca6b9
SSDEEP

24576:SNk+pJbDMZN3C3R2pEu4Vh4CdB8JYU6K5:S5JMZJWs+u4NLO6K

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1179499222463168573/PVUpZ1J1JtDuKSWVcXWilMvIlKb2Qchu7QhEEb_1sKVtTXLAEfM5aRMADIF1EWL0ZjkF

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

60 api.ipify.org
61 api.ipify.org

flow	ioc
60	api.ipify.org
61	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

description	pid	process	target process
PID 552 set thread context of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

560 1532 WerFault.exe 3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

pid	pid_target	process	target process
560	1532	WerFault.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

pid	process
552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
1532	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
1532	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

description	pid	process
Token: SeDebugPrivilege	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
Token: SeDebugPrivilege	1532	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

description	pid	process	target process
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
PID 552 wrote to memory of 1532	552	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe	3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe

C:\Users\Admin\AppData\Local\Temp\3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
"C:\Users\Admin\AppData\Local\Temp\3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552

C:\Users\Admin\AppData\Local\Temp\3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe
"C:\Users\Admin\AppData\Local\Temp\3b87c1ff0576d0f7c3595554245adba16dc0b6aa4f4d7b658dd1b803c7b76a39.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 2156
3⤵
- Program crash
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1532 -ip 1532
1⤵
PID:492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/552-8-0x0000000005F60000-0x0000000005F6A000-memory.dmp

Filesize
40KB

Download
memory/552-2-0x00000000051A0000-0x0000000005744000-memory.dmp

Filesize
5.6MB

Download
memory/552-9-0x0000000007520000-0x000000000759C000-memory.dmp

Filesize
496KB

Download
memory/552-10-0x0000000006060000-0x00000000060FC000-memory.dmp

Filesize
624KB

Download
memory/552-4-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/552-5-0x0000000004D00000-0x0000000004D0A000-memory.dmp

Filesize
40KB

Download
memory/552-6-0x0000000005170000-0x0000000005188000-memory.dmp

Filesize
96KB

Download
memory/552-7-0x0000000005E50000-0x0000000005E58000-memory.dmp

Filesize
32KB

Download
memory/552-0-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download
memory/552-1-0x0000000000070000-0x0000000000146000-memory.dmp

Filesize
856KB

Download
memory/552-3-0x0000000004B30000-0x0000000004BC2000-memory.dmp

Filesize
584KB

Download
memory/552-13-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download
memory/1532-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1532-14-0x0000000005010000-0x0000000005076000-memory.dmp

Filesize
408KB

Download
memory/1532-16-0x00000000050B0000-0x00000000050C0000-memory.dmp

Filesize
64KB

Download
memory/1532-15-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download
memory/1532-17-0x00000000067F0000-0x0000000006840000-memory.dmp

Filesize
320KB

Download
memory/1532-18-0x00000000746E0000-0x0000000074E90000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads