agenttesla | f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94

General

Target

f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
Size

515KB
MD5

50fe45db27bd0cb3c2e02401892d1026
SHA1

783afcf38fa20a035a36102d73e1e2b8117a9cf4
SHA256

f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94
SHA512

0f5d17bdca4f2bf8559f5106f3f0d74e59034698efbfdc02d9aa5ac8a48bc1d18aed39d62891c0732a4e432c8900420b2e5471a4c412c2193e8546b10bd2beba

Score

10^/10

agenttesla metastealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.polimeter.com
Port:
587
Username:
[email protected]
Password:
5337776740

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3292-133-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1796 set thread context of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
3292	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
3292	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
Token: SeDebugPrivilege	3292	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 1736	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	86
PID 1796 wrote to memory of 1736	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	86
PID 1796 wrote to memory of 1736	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	86
PID 1796 wrote to memory of 3380	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	88
PID 1796 wrote to memory of 3380	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	88
PID 1796 wrote to memory of 3380	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	88
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90
PID 1796 wrote to memory of 3292	1796	f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe	90

C:\Users\Admin\AppData\Local\Temp\f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
"C:\Users\Admin\AppData\Local\Temp\f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Users\Admin\AppData\Local\Temp\f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
  "{path}"
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
  "{path}"
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f41f744791464ed5ca3ff6cf49cb253542ec31760f70b93a679cc809d1266c94.exe.log

Filesize
1KB

MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/1796-124-0x0000000000E90000-0x0000000000F16000-memory.dmp

Filesize
536KB

Download
memory/1796-125-0x0000000008340000-0x00000000088E4000-memory.dmp

Filesize
5.6MB

Download
memory/1796-126-0x0000000007D90000-0x0000000007E22000-memory.dmp

Filesize
584KB

Download
memory/1796-127-0x0000000007F30000-0x0000000007F3A000-memory.dmp

Filesize
40KB

Download
memory/1796-128-0x0000000008E20000-0x000000000934C000-memory.dmp

Filesize
5.2MB

Download
memory/1796-129-0x00000000094F0000-0x000000000958C000-memory.dmp

Filesize
624KB

Download
memory/3292-133-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3292-135-0x00000000060F0000-0x0000000006156000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing