agenttesla | ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024

General

Target

ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe
Size

708KB
MD5

18f6350205d7a67624a074a27f1f2205
SHA1

0266dcbfdf0cd5d981dbf789feafc9e1551076cd
SHA256

ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024
SHA512

60ee0b21b494bdabce951d7fd9183ea21043db3771255deda60f7f562d13e7282b8b9a9feb1f7b9e8b7a96329128e5523ff08bcbea3846d3aaaef56f67e27d27
SSDEEP

12288:Vy4CMwnO25WGOwk+0j6HUxJGDfU9LGni83zOa/16Hry39emN9jdYB7EWcdXlnHgO:IOKiMUxJcwSi83zf6LywmN9jdYBgdnp

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot7087485211:AAGqDmwbcFBhp_CbxxstK6UJ5DJqhNFqois/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 6 IoCs

resource	yara_rule
behavioral1/memory/2588-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2588-14-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2588-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2588-21-0x00000000049C0000-0x0000000004A00000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 6 IoCs

resource	yara_rule
behavioral1/memory/2588-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2588-14-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2588-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2588-21-0x00000000049C0000-0x0000000004A00000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with SmartAssembly 1 IoCs

resource	yara_rule
behavioral1/memory/2744-4-0x0000000000490000-0x000000000049C000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Detects executables referencing Windows vault credential objects. Observed in infostealers 6 IoCs

resource	yara_rule
behavioral1/memory/2588-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2588-14-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2588-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2588-21-0x00000000049C0000-0x0000000004A00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2588-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2588-14-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2588-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2588-21-0x00000000049C0000-0x0000000004A00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2588-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2588-14-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2588-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2588-21-0x00000000049C0000-0x0000000004A00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 6 IoCs

resource	yara_rule
behavioral1/memory/2588-9-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2588-14-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2588-16-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2588-21-0x00000000049C0000-0x0000000004A00000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2744 set thread context of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2588	RegSvcs.exe
2588	RegSvcs.exe
2660	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2588	RegSvcs.exe
Token: SeDebugPrivilege	2660	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2660	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	28
PID 2744 wrote to memory of 2660	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	28
PID 2744 wrote to memory of 2660	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	28
PID 2744 wrote to memory of 2660	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	28
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30
PID 2744 wrote to memory of 2588	2744	ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe	30

C:\Users\Admin\AppData\Local\Temp\ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe
"C:\Users\Admin\AppData\Local\Temp\ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2588-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-30-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/2588-29-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-20-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2588-21-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/2588-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2660-24-0x00000000702F0000-0x000000007089B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-25-0x00000000702F0000-0x000000007089B000-memory.dmp

Filesize
5.7MB

Download
memory/2660-26-0x0000000002550000-0x0000000002590000-memory.dmp

Filesize
256KB

Download
memory/2660-27-0x0000000002550000-0x0000000002590000-memory.dmp

Filesize
256KB

Download
memory/2660-28-0x00000000702F0000-0x000000007089B000-memory.dmp

Filesize
5.7MB

Download
memory/2744-0-0x0000000001010000-0x00000000010C6000-memory.dmp

Filesize
728KB

Download
memory/2744-5-0x0000000004990000-0x0000000004A12000-memory.dmp

Filesize
520KB

Download
memory/2744-4-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/2744-19-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2744-1-0x0000000074A30000-0x000000007511E000-memory.dmp

Filesize
6.9MB

Download
memory/2744-3-0x0000000000470000-0x0000000000482000-memory.dmp

Filesize
72KB

Download
memory/2744-2-0x0000000004FC0000-0x0000000005000000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing