agenttesla | 706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b

General

Target

706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe
Size

926KB
MD5

f473799ea543c3fac04a6afa72020b7d
SHA1

dad26d4e0959972fd5d1496681f8ce2194e1cdea
SHA256

706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b
SHA512

18419fe2a232e5bbc03a497b569fdb3186a43c73f4ed356ef16acdfc75a41fe109279de585527cc093c3a1df231f1e1773025cccfe10552553c19acf48da280d
SSDEEP

12288:cK/yFXMuw8LSAhtQLojnpU0OysB3KIV08LHn+uyPZnRdAfQFShSZkRlx:cKuXnw8LS8tHjpjSBnJDORaHA6Rlx

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.normagroup.com.tr
Port:
21
Username:
[email protected]
Password:
ab+LNvim5PAo

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1044	installutil.exe
1044	installutil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	installutil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1044	installutil.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 1044	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	28
PID 1728 wrote to memory of 2872	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	29
PID 1728 wrote to memory of 2872	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	29
PID 1728 wrote to memory of 2872	1728	706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe	29

C:\Users\Admin\AppData\Local\Temp\706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe
"C:\Users\Admin\AppData\Local\Temp\706b0a2650de60ba4be3a9101c417d12cde938cd7655210d81f7ae5437c7bf1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1728 -s 652
  2⤵
  PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1044-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1044-23-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/1044-22-0x00000000748DE000-0x00000000748DF000-memory.dmp

Filesize
4KB

Download
memory/1044-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1044-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1044-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1044-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1044-19-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Filesize
6.9MB

Download
memory/1044-18-0x00000000748DE000-0x00000000748DF000-memory.dmp

Filesize
4KB

Download
memory/1044-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1044-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1728-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/1728-1-0x0000000001090000-0x00000000010A2000-memory.dmp

Filesize
72KB

Download
memory/1728-20-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/1728-21-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/1728-3-0x000000001A5C0000-0x000000001A652000-memory.dmp

Filesize
584KB

Download
memory/1728-2-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing