agenttesla | ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b

General

Target

ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
Size

675KB
MD5

6c11f38adec40c226ba26d9d0d505b45
SHA1

7ae903b71388e162dc4e10f65854cfb45de6d4fe
SHA256

ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b
SHA512

b01c32e389bd0d7a55777e023f0e29f39158ba762f24eabdc61d3ea6a34301da4ea1fff5705101d5a03161acf5088f69d6db3c717ce8ec055a3d746f0a81d45f

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.abaamap.com.mx
Port:
587
Username:
[email protected]
Password:
6.9)bx6}m*k}

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1940-127-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1940-128-0x000000000043787E-mapping.dmp	family_agenttesla
behavioral1/memory/1940-134-0x0000000004CF0000-0x00000000051EE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

description	pid	process	target process
PID 1252 set thread context of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

pid	process
1940	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
1940	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

description pid process

Token: SeDebugPrivilege 1940 ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

description	pid	process
Token: SeDebugPrivilege	1940	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

description	pid	process	target process
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
PID 1252 wrote to memory of 1940	1252	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe	ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe

C:\Users\Admin\AppData\Local\Temp\ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
"C:\Users\Admin\AppData\Local\Temp\ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Users\Admin\AppData\Local\Temp\ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe
  "C:\Users\Admin\AppData\Local\Temp\ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ca2e0c4c5d77ac010eac33e309b31022a08125703ac87a71c319ab50d946aa6b.exe.log

MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
memory/1252-125-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/1252-121-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/1252-122-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/1252-123-0x0000000004E80000-0x000000000537E000-memory.dmp

Filesize
5.0MB

Download
memory/1252-124-0x0000000004F00000-0x0000000004F0E000-memory.dmp

Filesize
56KB

Download
memory/1252-118-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1252-126-0x0000000005AE0000-0x0000000005B38000-memory.dmp

Filesize
352KB

Download
memory/1252-120-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/1940-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1940-128-0x000000000043787E-mapping.dmp

Download
memory/1940-134-0x0000000004CF0000-0x00000000051EE000-memory.dmp

Filesize
5.0MB

Download
memory/1940-135-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/1940-136-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads