agenttesla | 870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165

General

Target

870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe
Size

3.4MB
MD5

b7b135030bb68eaf0216005ade7bdf5c
SHA1

3c827e3c9bdb7bc3b24bbd07fcb40ef642d02f6c
SHA256

870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165
SHA512

b315d4274669febd5cfdabd89061d8324ba1044076790a556aacbacfbacef610a6973c38639c054343f3e472f678915a2d45e88545e04123472068793498d988
SSDEEP

49152:dp98Mq2HVhpanF+p1Tjr90vkvGhETXqfi77robXgpJGpAJobrSyuJzflk5QeAC+9:dR1hW+R0P6X9rAgD83NX0VtUlFGp

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.normagroup.com.tr
Port:
21
Username:
[email protected]
Password:
ab+LNvim5PAo

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.normagroup.com.tr
Port:
21
Username:
[email protected]
Password:
ab+LNvim5PAo

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe

description	pid	process	target process
PID 4480 set thread context of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jsc.exe

pid process

4492 jsc.exe
4492 jsc.exe

pid	process
4492	jsc.exe
4492	jsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exejsc.exe

description	pid	process
Token: SeDebugPrivilege	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe
Token: SeDebugPrivilege	4492	jsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

jsc.exe

pid process

4492 jsc.exe

pid	process
4492	jsc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe

description	pid	process	target process
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 4492	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 3488	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 3488	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe
PID 4480 wrote to memory of 3488	4480	870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe
"C:\Users\Admin\AppData\Local\Temp\870973cd645d6cc18bfa1e9e95c1ba7837ed46fcdd04569fc03475baa84d1165.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
2⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3676 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4480-7-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/4480-1-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/4480-2-0x000001F552520000-0x000001F552530000-memory.dmp

Filesize
64KB

Download
memory/4480-3-0x000001F552530000-0x000001F55280C000-memory.dmp

Filesize
2.9MB

Download
memory/4480-4-0x000001F539A00000-0x000001F539A96000-memory.dmp

Filesize
600KB

Download
memory/4480-0-0x000001F537BC0000-0x000001F537E9C000-memory.dmp

Filesize
2.9MB

Download
memory/4492-8-0x0000000005F80000-0x0000000006524000-memory.dmp

Filesize
5.6MB

Download
memory/4492-6-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/4492-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4492-9-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/4492-10-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/4492-11-0x0000000006780000-0x00000000067D0000-memory.dmp

Filesize
320KB

Download
memory/4492-12-0x0000000006870000-0x000000000690C000-memory.dmp

Filesize
624KB

Download
memory/4492-13-0x0000000006F30000-0x0000000006FC2000-memory.dmp

Filesize
584KB

Download
memory/4492-14-0x0000000007110000-0x000000000711A000-memory.dmp

Filesize
40KB

Download
memory/4492-15-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/4492-16-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads