agenttesla | c5ac196d88b4a5acfd9d2278df2129e4034518263526e84eb8e0c8617dde63be

General

Target

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
Size

1012KB
MD5

0d369ff4696ecb4abbccc7eabe5711b8
SHA1

9ad99109bd4e3a87c3a22026c71debefcd97b907
SHA256

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01
SHA512

fed89f204acccde867f1b8dabcf10f5edcd56b5811e10db061dcf90b9c2c796fb2afa85d2feeffc28f77e772e724ba37a95dab44cc843b1fdcf6441f5b0a442d

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.sidlewtex.com
Port:
587
Username:
sales@sidlewtex.com
Password:
swyvt(K2

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1020-124-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1020-125-0x000000000043749E-mapping.dmp	family_agenttesla
behavioral2/memory/1020-131-0x0000000005770000-0x0000000005C6E000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/628-122-0x0000000004BC0000-0x0000000004BC3000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

description	pid	process	target process
PID 628 set thread context of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

pid	process
628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
1020	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
1020	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

description	pid	process
Token: SeDebugPrivilege	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
Token: SeDebugPrivilege	1020	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

description	pid	process	target process
PID 628 wrote to memory of 2880	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 2880	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 2880	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
PID 628 wrote to memory of 1020	628	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe	2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe

C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
"C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628

C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
"C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe"
2⤵
PID:2880

C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe
"C:\Users\Admin\AppData\Local\Temp\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2bef0c5c20d349645940b6645431990aa3b9cc845f5d89a7c91cf5d7a9275a01.exe.log
MD5
90acfd72f14a512712b1a7380c0faf60

SHA1
40ba4accb8faa75887e84fb8e38d598dc8cf0f12

SHA256
20806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86

SHA512
29dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9

Download Submit
memory/628-121-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/628-123-0x00000000057E0000-0x0000000005848000-memory.dmp

Filesize
416KB

Download
memory/628-118-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/628-119-0x0000000004B30000-0x000000000502E000-memory.dmp

Filesize
5.0MB

Download
memory/628-120-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/628-122-0x0000000004BC0000-0x0000000004BC3000-memory.dmp

Filesize
12KB

Download
memory/628-117-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/628-116-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/1020-125-0x000000000043749E-mapping.dmp

Download
memory/1020-124-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1020-131-0x0000000005770000-0x0000000005C6E000-memory.dmp

Filesize
5.0MB

Download
memory/1020-132-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/1020-133-0x0000000006460000-0x0000000006461000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads