agenttesla | fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb

General

Target

fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe
Size

742KB
MD5

b368bfdd1b4cddcfcf8e843a8972fb11
SHA1

0cd5fc60caf4d14ba898d39608b7228f99df393e
SHA256

fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb
SHA512

b3c4f591ed09b9a53b6f1f8e9e5c9ccdaaf3c93f7c91ed0c35b7904f6da56a97e9634ae1216925865e1b4cb5fb5b7c8e2b702e08c0123be7014d3f2c09b8dd09
SSDEEP

12288:U9a4GFx/lUSE2qrpNCskXkImdzG4K3/6uCTAInZtNZ73pLDOZd05y61Zj52+vNnG:U9GFNlUXkX4o16VU47s+y6LF2cnOB6lC

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.fasmacopy.gr
Port:
587
Username:
[email protected]
Password:
Fam28sjd
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs

resource	yara_rule
behavioral1/memory/2604-18-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2604-17-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2604-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2604-11-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01
behavioral1/memory/2604-9-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs

resource	yara_rule
behavioral1/memory/2604-18-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2604-17-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2604-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2604-11-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/2604-9-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables packed with or use KoiVM 1 IoCs

resource	yara_rule
behavioral1/memory/1680-4-0x0000000001FB0000-0x0000000002042000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs

resource	yara_rule
behavioral1/memory/2604-18-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2604-17-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2604-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2604-11-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID
behavioral1/memory/2604-9-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2604-18-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2604-17-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2604-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2604-11-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral1/memory/2604-9-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2604-18-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2604-17-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2604-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2604-11-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients
behavioral1/memory/2604-9-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs

resource	yara_rule
behavioral1/memory/2604-18-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2604-17-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2604-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2604-11-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients
behavioral1/memory/2604-9-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	installutil.exe
2604	installutil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	installutil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2604	installutil.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2604	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	29
PID 1680 wrote to memory of 2536	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	30
PID 1680 wrote to memory of 2536	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	30
PID 1680 wrote to memory of 2536	1680	fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe	30

C:\Users\Admin\AppData\Local\Temp\fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe
"C:\Users\Admin\AppData\Local\Temp\fcc73e0f15f5ea39a9683a4e545263ce548278650beb4c4c36db3fd443133fdb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1680 -s 684
  2⤵
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-0-0x000007FEF5A43000-0x000007FEF5A44000-memory.dmp

Filesize
4KB

Download
memory/1680-1-0x00000000003C0000-0x00000000003EE000-memory.dmp

Filesize
184KB

Download
memory/1680-2-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download
memory/1680-3-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1680-4-0x0000000001FB0000-0x0000000002042000-memory.dmp

Filesize
584KB

Download
memory/1680-22-0x000007FEF5A40000-0x000007FEF642C000-memory.dmp

Filesize
9.9MB

Download
memory/1680-21-0x000007FEF5A43000-0x000007FEF5A44000-memory.dmp

Filesize
4KB

Download
memory/2604-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2604-20-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/2604-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2604-19-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/2604-23-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/2604-24-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing