agenttesla | 9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738

General

Target

9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe
Size

722KB
MD5

e1b84cc702389fffaeecf94481e7158d
SHA1

3b0e8e30f939c27e1e367310a0574d095b49eb0a
SHA256

9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738
SHA512

be04219495a6bf75c853ec530d298a4be1b6cbfe54e81cdcbe6286643f774325d86dd2a26da5fb6cac253cb7e9d534738660581f29e07d715caaa1a150f06c86
SSDEEP

12288:C/w5nF8ME6jD/L636xR123PtBojgkVC/pqCy+xeeODKnrWC8xxTlCRVW:CYPtD/KI123PbLEseF284VW

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.trisquarespl.com
Port:
587
Username:
[email protected]
Password:
vphYSHb*2
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

51 api.ipify.org
50 api.ipify.org

flow	ioc
51	api.ipify.org
50	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe

description	pid	process	target process
PID 388 set thread context of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2312 3364 WerFault.exe RegSvcs.exe

pid	pid_target	process	target process
2312	3364	WerFault.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exeRegSvcs.exe

pid	process
388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe
388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe
3364	RegSvcs.exe
3364	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe
Token: SeDebugPrivilege	3364	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe

description	pid	process	target process
PID 388 wrote to memory of 4824	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 4824	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 4824	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe
PID 388 wrote to memory of 3364	388	9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe
"C:\Users\Admin\AppData\Local\Temp\9313fe726df71a9a251ff4c7cbeacd9ddd6f187a747c4d3f25f93ecc070de738.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:4824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 1984
3⤵
- Program crash
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3364 -ip 3364
1⤵
PID:2504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/388-8-0x00000000056F0000-0x00000000056FA000-memory.dmp

Filesize
40KB

Download
memory/388-4-0x0000000005390000-0x00000000053A0000-memory.dmp

Filesize
64KB

Download
memory/388-0-0x0000000000660000-0x000000000071A000-memory.dmp

Filesize
744KB

Download
memory/388-3-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/388-9-0x0000000007B10000-0x0000000007B8A000-memory.dmp

Filesize
488KB

Download
memory/388-5-0x0000000005110000-0x000000000511A000-memory.dmp

Filesize
40KB

Download
memory/388-6-0x00000000056B0000-0x00000000056C8000-memory.dmp

Filesize
96KB

Download
memory/388-10-0x0000000006550000-0x00000000065EC000-memory.dmp

Filesize
624KB

Download
memory/388-2-0x0000000005710000-0x0000000005CB4000-memory.dmp

Filesize
5.6MB

Download
memory/388-1-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/388-7-0x00000000056E0000-0x00000000056E8000-memory.dmp

Filesize
32KB

Download
memory/388-13-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/3364-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3364-14-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/3364-15-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/3364-16-0x0000000005880000-0x00000000058E6000-memory.dmp

Filesize
408KB

Download
memory/3364-17-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads