agenttesla | d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d

General

Target

d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe
Size

736KB
MD5

36ddd1dffdf875e7508e7a97ae2fca28
SHA1

bb226ed21720c6d636bde06559721e5411dc00c1
SHA256

d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d
SHA512

416831748aceb8a7393a9f745b60aafdf5d0db3a174b5473bc99ec2c790c0d450f2108e0a11107f0e7e98987442c0fbdabd61342943d40d95aed942662fa45fb
SSDEEP

12288:M5+li8LkpEaGky9cDiUq+M74DhRLHmCC6sCgsL3eMzytkqd78IO3U/69Hs60t1SY:YjEa1G4DhRLHmgRzqNRO3USh6t

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.ru
Port:
587
Username:
[email protected]
Password:
graceofgod@amen
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 api.ipify.org
21 api.ipify.org

flow	ioc
22	api.ipify.org
21	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe

description	pid	process	target process
PID 1568 set thread context of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exeRegSvcs.exe

pid	process
1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe
1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe
1800	RegSvcs.exe
1800	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe
Token: SeDebugPrivilege	1800	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1800 RegSvcs.exe

pid	process
1800	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe

description	pid	process	target process
PID 1568 wrote to memory of 2292	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 2292	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 2292	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe
PID 1568 wrote to memory of 1800	1568	d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe
"C:\Users\Admin\AppData\Local\Temp\d5f29a50645c9638fc922d28d80d71dbdd2beae8a12fa992ac4ac36707f1cb1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-8-0x0000000009340000-0x00000000093C2000-memory.dmp

Filesize
520KB

Download
memory/1568-4-0x00000000032A0000-0x00000000032AA000-memory.dmp

Filesize
40KB

Download
memory/1568-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

Filesize
4KB

Download
memory/1568-3-0x0000000007EB0000-0x0000000007F42000-memory.dmp

Filesize
584KB

Download
memory/1568-9-0x0000000006C30000-0x0000000006CCC000-memory.dmp

Filesize
624KB

Download
memory/1568-5-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1568-6-0x0000000008100000-0x000000000811A000-memory.dmp

Filesize
104KB

Download
memory/1568-12-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1568-2-0x0000000008380000-0x0000000008924000-memory.dmp

Filesize
5.6MB

Download
memory/1568-1-0x0000000000F10000-0x0000000000FCE000-memory.dmp

Filesize
760KB

Download
memory/1568-7-0x0000000008120000-0x0000000008130000-memory.dmp

Filesize
64KB

Download
memory/1800-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1800-13-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1800-14-0x0000000005540000-0x00000000055A6000-memory.dmp

Filesize
408KB

Download
memory/1800-15-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download
memory/1800-16-0x0000000006970000-0x00000000069C0000-memory.dmp

Filesize
320KB

Download
memory/1800-17-0x0000000074F50000-0x0000000075700000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads