agenttesla | aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322

General

Target

aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
Size

756KB
MD5

0f336e8e46a795e9dff2585f72e46c22
SHA1

4da7e197b297756abde642d83b208ed3498775fb
SHA256

aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322
SHA512

691c2fba7679417bb95a968bab7608ca292fe8659ad69936fed913a7d54cd61d766862d180379191fe346cd8abd2bb0eefb7837a12e989af1eb428c74acc961b
SSDEEP

12288:szQIYsNpaWi59B582PHa2dT3/36vKMtwRMmVcKMl/GT+3+2+W9Y:sz/859B582P62db/23wRMJl6JhoY

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.aksumer.com
Port:
21
Username:
aksumerc
Password:
211116.kS*-

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

description	pid	process	target process
PID 2788 set thread context of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

pid	process
4316	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
4316	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
4316	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

description pid process

Token: SeDebugPrivilege 4316 aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

description	pid	process
Token: SeDebugPrivilege	4316	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

description	pid	process	target process
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
PID 2788 wrote to memory of 4316	2788	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe	aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe

C:\Users\Admin\AppData\Local\Temp\aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
"C:\Users\Admin\AppData\Local\Temp\aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2788

C:\Users\Admin\AppData\Local\Temp\aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe
"C:\Users\Admin\AppData\Local\Temp\aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aaa7f269998ab8f868fc880124e6e15e7872f32d3508d54a90fc1cdf443a8322.exe.log

Filesize
1KB

MD5
b7b9acb869ccc7f7ecb5304ec0384dee

SHA1
6a90751c95817903ee833d59a0abbef425a613b3

SHA256
8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4

SHA512
7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

Download Submit
memory/2788-9-0x0000000007330000-0x0000000007338000-memory.dmp

Filesize
32KB

Download
memory/2788-18-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/2788-3-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/2788-4-0x00000000059F0000-0x0000000005D44000-memory.dmp

Filesize
3.3MB

Download
memory/2788-5-0x00000000058E0000-0x00000000058F0000-memory.dmp

Filesize
64KB

Download
memory/2788-6-0x0000000005E30000-0x0000000005E3A000-memory.dmp

Filesize
40KB

Download
memory/2788-7-0x00000000065F0000-0x000000000668C000-memory.dmp

Filesize
624KB

Download
memory/2788-11-0x00000000077B0000-0x000000000783A000-memory.dmp

Filesize
552KB

Download
memory/2788-10-0x0000000007340000-0x000000000734A000-memory.dmp

Filesize
40KB

Download
memory/2788-2-0x0000000005FA0000-0x0000000006544000-memory.dmp

Filesize
5.6MB

Download
memory/2788-8-0x0000000006840000-0x0000000006856000-memory.dmp

Filesize
88KB

Download
memory/2788-1-0x0000000000E70000-0x0000000000F34000-memory.dmp

Filesize
784KB

Download
memory/2788-0-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4316-19-0x0000000006240000-0x0000000006290000-memory.dmp

Filesize
320KB

Download
memory/4316-15-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4316-17-0x0000000004F60000-0x0000000004FC6000-memory.dmp

Filesize
408KB

Download
memory/4316-16-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/4316-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4316-20-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4316-21-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads