agenttesla | 8fc5983522a6e3300574f6890d02a51c7da7143dcff9d00adfabefb9edc20fb8

General

Target

d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe
Size

781KB
MD5

5b43ef2d931de1993c4248bf399c1fd8
SHA1

ed608317e496b4518c80bd4cd57c8172df8cd484
SHA256

d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae
SHA512

a4d31809ed1f3abc4df4f840bf6bb884470badbd00b37666536bf68c33e9cf24a712dda9e0530625256b488f69fcc381338f705d4306cbf6a5ddadc145ecd2af
SSDEEP

24576:yV68yq0N46w9Bk+pO4rhiRsUVI6AMH9cx:yVsqCiDpHQR10MH

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.epressong.com
Port:
587
Username:
[email protected]
Password:
hkZsJ$e2
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	api.ipify.org
28	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe
4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe
4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe
4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe
4904	RegSvcs.exe
4904	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe
Token: SeDebugPrivilege	4904	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3896	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	88
PID 4948 wrote to memory of 3896	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	88
PID 4948 wrote to memory of 3896	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	88
PID 4948 wrote to memory of 4296	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	89
PID 4948 wrote to memory of 4296	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	89
PID 4948 wrote to memory of 4296	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	89
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90
PID 4948 wrote to memory of 4904	4948	d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe	90

C:\Users\Admin\AppData\Local\Temp\d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe
"C:\Users\Admin\AppData\Local\Temp\d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4904-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4904-19-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/4904-18-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/4904-17-0x0000000006620000-0x0000000006670000-memory.dmp

Filesize
320KB

Download
memory/4904-16-0x00000000053E0000-0x0000000005446000-memory.dmp

Filesize
408KB

Download
memory/4904-15-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/4904-14-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/4948-4-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/4948-8-0x0000000005FD0000-0x0000000005FDA000-memory.dmp

Filesize
40KB

Download
memory/4948-9-0x0000000005FE0000-0x0000000005FEE000-memory.dmp

Filesize
56KB

Download
memory/4948-10-0x0000000007740000-0x00000000077C2000-memory.dmp

Filesize
520KB

Download
memory/4948-7-0x00000000056D0000-0x00000000056E4000-memory.dmp

Filesize
80KB

Download
memory/4948-6-0x00000000055F0000-0x000000000568C000-memory.dmp

Filesize
624KB

Download
memory/4948-13-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/4948-5-0x0000000005510000-0x000000000551A000-memory.dmp

Filesize
40KB

Download
memory/4948-0-0x00000000008B0000-0x000000000097A000-memory.dmp

Filesize
808KB

Download
memory/4948-3-0x0000000005380000-0x0000000005412000-memory.dmp

Filesize
584KB

Download
memory/4948-2-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/4948-1-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing