agenttesla | c5ac196d88b4a5acfd9d2278df2129e4034518263526e84eb8e0c8617dde63be

General

Target

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
Size

1012KB
MD5

0d369ff4696ecb4abbccc7eabe5711b8
SHA1

9ad99109bd4e3a87c3a22026c71debefcd97b907
SHA256

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01
SHA512

fed89f204acccde867f1b8dabcf10f5edcd56b5811e10db061dcf90b9c2c796fb2afa85d2feeffc28f77e772e724ba37a95dab44cc843b1fdcf6441f5b0a442d

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.sidlewtex.com
Port:
587
Username:
sales@sidlewtex.com
Password:
swyvt(K2

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1692-66-0x000000000043749E-mapping.dmp	family_agenttesla
behavioral1/memory/1692-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/452-63-0x00000000009F0000-0x00000000009F3000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

description	pid	process	target process
PID 452 set thread context of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

pid	process
1692	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
1692	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

description pid process

Token: SeDebugPrivilege 1692 2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

description	pid	process
Token: SeDebugPrivilege	1692	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

description	pid	process	target process
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 452 wrote to memory of 1692	452	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
"C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:452

C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
"C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/452-60-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/452-62-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/452-63-0x00000000009F0000-0x00000000009F3000-memory.dmp

Filesize
12KB

Download
memory/452-64-0x0000000004DD0000-0x0000000004E38000-memory.dmp

Filesize
416KB

Download
memory/1692-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1692-66-0x000000000043749E-mapping.dmp

Download
memory/1692-67-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1692-69-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads