agenttesla | 65778b8834d7849f816c747ae7f3dfc5466ded7781b34959d53cb1a544aaeef5

General

Target

5c2e20cf98a0d8918ddec80ef4ccf067.exe
Size

1.1MB
MD5

5c2e20cf98a0d8918ddec80ef4ccf067
SHA1

9615fe84d0193341f3d5b718fffc109197933c51
SHA256

65778b8834d7849f816c747ae7f3dfc5466ded7781b34959d53cb1a544aaeef5
SHA512

5f3b73a4eeba98d15103a5e26f4657daae94b17977047790649e24af26503b4568e88e0ae0202855cd51cc29167f56011d4f799e32f38a4e57b7153c67f3d933

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.lpsinvest.com
Port:
587
Username:
helio@lpsinvest.com
Password:
#@9$#@9r1jDC2BLR

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1136-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1136-126-0x00000000004375FE-mapping.dmp	family_agenttesla
behavioral2/memory/1136-132-0x0000000005360000-0x000000000585E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c2e20cf98a0d8918ddec80ef4ccf067.exe

description pid process target process

PID 3920 set thread context of 1136 3920 5c2e20cf98a0d8918ddec80ef4ccf067.exe 5c2e20cf98a0d8918ddec80ef4ccf067.exe

description	pid	process	target process
PID 3920 set thread context of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

5c2e20cf98a0d8918ddec80ef4ccf067.exe5c2e20cf98a0d8918ddec80ef4ccf067.exe

pid	process
3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe
3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe
3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe
1136	5c2e20cf98a0d8918ddec80ef4ccf067.exe
1136	5c2e20cf98a0d8918ddec80ef4ccf067.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5c2e20cf98a0d8918ddec80ef4ccf067.exe5c2e20cf98a0d8918ddec80ef4ccf067.exe

description pid process

Token: SeDebugPrivilege 3920 5c2e20cf98a0d8918ddec80ef4ccf067.exe
Token: SeDebugPrivilege 1136 5c2e20cf98a0d8918ddec80ef4ccf067.exe

description	pid	process
Token: SeDebugPrivilege	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe
Token: SeDebugPrivilege	1136	5c2e20cf98a0d8918ddec80ef4ccf067.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5c2e20cf98a0d8918ddec80ef4ccf067.exe

description	pid	process	target process
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe
PID 3920 wrote to memory of 1136	3920	5c2e20cf98a0d8918ddec80ef4ccf067.exe	5c2e20cf98a0d8918ddec80ef4ccf067.exe

C:\Users\Admin\AppData\Local\Temp\5c2e20cf98a0d8918ddec80ef4ccf067.exe
"C:\Users\Admin\AppData\Local\Temp\5c2e20cf98a0d8918ddec80ef4ccf067.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920

C:\Users\Admin\AppData\Local\Temp\5c2e20cf98a0d8918ddec80ef4ccf067.exe
"C:\Users\Admin\AppData\Local\Temp\5c2e20cf98a0d8918ddec80ef4ccf067.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5c2e20cf98a0d8918ddec80ef4ccf067.exe.log
MD5
c3cc52ccca9ff2b6fa8d267fc350ca6b

SHA1
a68d4028333296d222e4afd75dea36fdc98d05f3

SHA256
3125b6071e2d78f575a06ed7ac32a83d9262ae64d1fa81ac43e8bfc1ef157c0e

SHA512
b0c7b2501b1a2c559795a9d178c0bbda0e03cbdbaaa2c4330ac1202a55373fe1b742078adcfa915bd6e805565a2daa6d35d64ef7a14ffcd09069f9ea6a691cc7

Download Submit
memory/1136-125-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1136-134-0x00000000060C0000-0x00000000060C1000-memory.dmp

Filesize
4KB

Download
memory/1136-133-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/1136-132-0x0000000005360000-0x000000000585E000-memory.dmp

Filesize
5.0MB

Download
memory/1136-126-0x00000000004375FE-mapping.dmp

Download
memory/3920-119-0x0000000005310000-0x000000000580E000-memory.dmp

Filesize
5.0MB

Download
memory/3920-122-0x000000007E970000-0x000000007E971000-memory.dmp

Filesize
4KB

Download
memory/3920-123-0x0000000001120000-0x0000000001195000-memory.dmp

Filesize
468KB

Download
memory/3920-124-0x0000000008500000-0x000000000853C000-memory.dmp

Filesize
240KB

Download
memory/3920-121-0x0000000005800000-0x0000000005809000-memory.dmp

Filesize
36KB

Download
memory/3920-120-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/3920-114-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/3920-118-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/3920-117-0x0000000005310000-0x0000000005311000-memory.dmp

Filesize
4KB

Download
memory/3920-116-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads