agenttesla | b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac

General

Target

b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe
Size

774KB
MD5

4141f38c9f778f2d1af6da00d1ea523d
SHA1

a06b763817b65f3ec17dc7c47659f03a4347452a
SHA256

b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac
SHA512

906e9328329b01c38f0457b2397546b27753c028e714317c5aa9aaf49292a7be95dea179655773f98d4e6a676f9506acc927e8de7d17f5828e466a77245b29b4
SSDEEP

12288:ovnFtImAFNyr+uxiCvAcr+DD8QMDNeskiesEiT8KFi/QKa6HOkQ1Hs1bNAtTmrE:qF61FaliZZvBE3eOFuQKa6MHsmt6

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.dagcan.com.tr
Port:
587
Username:
[email protected]
Password:
dagcan2022

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.dagcan.com.tr
Port:
587
Username:
[email protected]
Password:
dagcan2022
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
11	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe
1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe
1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe
2992	RegSvcs.exe
2992	RegSvcs.exe
2428	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe
Token: SeDebugPrivilege	2992	RegSvcs.exe
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe
1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2428	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	29
PID 1644 wrote to memory of 2428	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	29
PID 1644 wrote to memory of 2428	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	29
PID 1644 wrote to memory of 2428	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	29
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31
PID 1644 wrote to memory of 2992	1644	b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe	31

C:\Users\Admin\AppData\Local\Temp\b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe
"C:\Users\Admin\AppData\Local\Temp\b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b3985003a5217f93f8f56dcc6ade5e6bc01caa603a49515573882aa1c04af7ac.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-44-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1644-1-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1644-2-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1644-3-0x0000000004D00000-0x0000000004D40000-memory.dmp

Filesize
256KB

Download
memory/1644-4-0x0000000004F00000-0x0000000004F14000-memory.dmp

Filesize
80KB

Download
memory/1644-28-0x0000000005E40000-0x0000000005E4A000-memory.dmp

Filesize
40KB

Download
memory/1644-29-0x0000000008660000-0x000000000866E000-memory.dmp

Filesize
56KB

Download
memory/1644-30-0x0000000008880000-0x0000000008904000-memory.dmp

Filesize
528KB

Download
memory/1644-0-0x00000000002D0000-0x0000000000398000-memory.dmp

Filesize
800KB

Download
memory/2428-54-0x000000006F770000-0x000000006FD1B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-52-0x0000000002BF0000-0x0000000002C30000-memory.dmp

Filesize
256KB

Download
memory/2428-49-0x000000006F770000-0x000000006FD1B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-50-0x000000006F770000-0x000000006FD1B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-51-0x0000000002BF0000-0x0000000002C30000-memory.dmp

Filesize
256KB

Download
memory/2428-53-0x0000000002BF0000-0x0000000002C30000-memory.dmp

Filesize
256KB

Download
memory/2992-35-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-47-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2992-48-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download
memory/2992-32-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-41-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-34-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-33-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-43-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-39-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2992-55-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2992-56-0x0000000004C50000-0x0000000004C90000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads