agenttesla | 6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323

General

Target

6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe
Size

888KB
MD5

7c5508484d8b61155b13bb8476fb5f70
SHA1

ab2be33782022e9f04dcbe25633d5c362193ecf3
SHA256

6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323
SHA512

7245fe40ba2ae2f81ac956b71b9962eee64382e3171da3f4d55a9748ee992ee3c861d02712d5aa0f04155146879a58d6bee966dd5e638d413593b26d2ecf9643
SSDEEP

24576:2wGf9bYNj0WU66TcnohHWJxpyz+epkQ4/Kh9YX3:A6OWU6dUoxpy14/KUH

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hatiplertekstil.com
Port:
587
Username:
[email protected]
Password:
htpl102030
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1420 set thread context of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4980	regsvcs.exe
4980	regsvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe
Token: SeDebugPrivilege	4980	regsvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4980	regsvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 3868	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	92
PID 1420 wrote to memory of 3868	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	92
PID 1420 wrote to memory of 3868	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	92
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 4980	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	93
PID 1420 wrote to memory of 2440	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	94
PID 1420 wrote to memory of 2440	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	94
PID 1420 wrote to memory of 2440	1420	6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe	94

C:\Users\Admin\AppData\Local\Temp\6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe
"C:\Users\Admin\AppData\Local\Temp\6227a5500df53be8c94473aaed2479610329568b55142ca56120c94f9c0dd323.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:3868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  PID:2440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-6-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/1420-1-0x00007FF82DDE0000-0x00007FF82E8A1000-memory.dmp

Filesize
10.8MB

Download
memory/1420-2-0x000002AD42890000-0x000002AD428A0000-memory.dmp

Filesize
64KB

Download
memory/1420-3-0x000002AD42790000-0x000002AD42826000-memory.dmp

Filesize
600KB

Download
memory/1420-0-0x000002AD282A0000-0x000002AD282F0000-memory.dmp

Filesize
320KB

Download
memory/4980-10-0x0000000006250000-0x00000000062A0000-memory.dmp

Filesize
320KB

Download
memory/4980-5-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4980-8-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download
memory/4980-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4980-9-0x0000000005360000-0x00000000053C6000-memory.dmp

Filesize
408KB

Download
memory/4980-7-0x00000000059A0000-0x0000000005F44000-memory.dmp

Filesize
5.6MB

Download
memory/4980-11-0x0000000006340000-0x00000000063D2000-memory.dmp

Filesize
584KB

Download
memory/4980-12-0x00000000064D0000-0x00000000064DA000-memory.dmp

Filesize
40KB

Download
memory/4980-13-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4980-14-0x00000000053E0000-0x00000000053F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing