agenttesla | 17d1ef802af949ebabcb1b36a3fffdd5854e59e5c4ec65af1f66f952f65e9a32

General

Target

a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe
Size

1.0MB
MD5

5de229b7fd3c91d03a721ae44214e3aa
SHA1

92c4645f075bec1f2a2285f1d3d10bb2b6cdf745
SHA256

a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2
SHA512

429d56e5d2a8d828e70182febd0af1893d05d789c1a3197c808e043ee1371eed078f06114f256e6b2d9629a42143a9536dc758ca01323ecce2f032cbee2ec6f9
SSDEEP

24576:TAHnh+eWsN3skA4RV1Hom2KXMmHa3VHMYLlMVj0KKwwWO5:eh+ZkldoPK8Ya39xLWhnc

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.antoniomayol.com:21
Port:
21
Username:
[email protected]
Password:
cMhKDQUk1{;%

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vaccinatory.vbs	vaccinatory.exe

Executes dropped EXE 1 IoCs

pid	Process
3992	vaccinatory.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023414-13.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3992 set thread context of 464	3992	vaccinatory.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
464	RegSvcs.exe
464	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3992	vaccinatory.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4508	a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe
4508	a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe
3992	vaccinatory.exe
3992	vaccinatory.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4508	a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe
4508	a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe
3992	vaccinatory.exe
3992	vaccinatory.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3992	4508	a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe	85
PID 4508 wrote to memory of 3992	4508	a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe	85
PID 4508 wrote to memory of 3992	4508	a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe	85
PID 3992 wrote to memory of 464	3992	vaccinatory.exe	86
PID 3992 wrote to memory of 464	3992	vaccinatory.exe	86
PID 3992 wrote to memory of 464	3992	vaccinatory.exe	86
PID 3992 wrote to memory of 464	3992	vaccinatory.exe	86

C:\Users\Admin\AppData\Local\Temp\a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe
"C:\Users\Admin\AppData\Local\Temp\a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\derogates\vaccinatory.exe
  "C:\Users\Admin\AppData\Local\Temp\a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\demonetising

Filesize
239KB

MD5
ba728d773dbf222d4886eaccc0ee9675

SHA1
73a39521a40e45eac8354974d4e0e3338776dd87

SHA256
ee563a5c91bee5bf6c734e0d209f8bf71b9aaa02e2ab07e5edde0a6acdfac71f

SHA512
25dd61ef0027ec38c732db296f0f1f16f68efc457ad8990f27e459edb0e70bfbd9396e3a64ee06b120b4f5c7670d547ff681fad1c3eea05f3466f14a6105f60f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lophophorine

Filesize
29KB

MD5
548c2148e266f939ea755be386cff149

SHA1
ad4472fcc66e6622867dc55724dbdbb2fbdeccdb

SHA256
d3662a783a7c79739d2133ad366add13c2899a17b078dfc78549e94ba5206e74

SHA512
89192f052a38eabe8ecfae6adb26021731ed211b14284b02e0c947ca77cce8152fbe0c5d405dd72c93e39dcdc346764d4e6e991286687761529f3df7cb97d2f9

Download Submit
C:\Users\Admin\AppData\Local\derogates\vaccinatory.exe

Filesize
1.0MB

MD5
5de229b7fd3c91d03a721ae44214e3aa

SHA1
92c4645f075bec1f2a2285f1d3d10bb2b6cdf745

SHA256
a025ca2161bf1125aa31aa65ba154f261f7dae204f7abfaf5ecf392eab8e9fc2

SHA512
429d56e5d2a8d828e70182febd0af1893d05d789c1a3197c808e043ee1371eed078f06114f256e6b2d9629a42143a9536dc758ca01323ecce2f032cbee2ec6f9

Download Submit
memory/464-30-0x0000000005E00000-0x00000000063A4000-memory.dmp

Filesize
5.6MB

Download
memory/464-28-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/464-29-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

Filesize
4KB

Download
memory/464-31-0x00000000057B0000-0x0000000005816000-memory.dmp

Filesize
408KB

Download
memory/464-32-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/464-33-0x00000000069D0000-0x0000000006A20000-memory.dmp

Filesize
320KB

Download
memory/464-34-0x0000000006B70000-0x0000000006C02000-memory.dmp

Filesize
584KB

Download
memory/464-35-0x0000000006A60000-0x0000000006A6A000-memory.dmp

Filesize
40KB

Download
memory/464-36-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

Filesize
4KB

Download
memory/464-37-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4508-10-0x00000000024F0000-0x00000000024F4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing