agenttesla | e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd

General

Target

e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
Size

670KB
MD5

3b82ffabb21740deb05b4f13014d0f94
SHA1

102f33cb27a23221f11dcbd218b649dcdcb4cfba
SHA256

e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd
SHA512

0aea7990c2915a119fd7004abe6dcde5dbb47fd22494e1966937301b2000abc1b2823a7233685ae819cc2b979c86184cbe9684ae519469493b1094ed432a08c9
SSDEEP

12288:4mvWCvxGbh3qbKSZYbiOAp4jvB85feoe1Hb9+w4N9GEyejjjjjjjjjjjROjjjjj9:uCpGeKSZaop4KeTh+w29v

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.parkandsports.com
Port:
587
Username:
[email protected]
Password:
Goknur72
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2236-141-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

description	pid	process	target process
PID 3376 set thread context of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exee6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

pid	process
3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
2236	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
2236	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exee6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

description	pid	process
Token: SeDebugPrivilege	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
Token: SeDebugPrivilege	2236	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

description	pid	process	target process
PID 3376 wrote to memory of 3492	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 3492	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 3492	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 4604	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 4604	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 4604	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
PID 3376 wrote to memory of 2236	3376	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe	e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe

C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
"C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376

C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
"C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe"
2⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
"C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe"
2⤵
PID:4604

C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe
"C:\Users\Admin\AppData\Local\Temp\e6a66069ecf660329729e4617d91430b631199175a4a35f1d7e7df54b97b2edd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-140-0x0000000000000000-mapping.dmp

Download
memory/2236-141-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2236-142-0x0000000005A00000-0x0000000005A66000-memory.dmp

Filesize
408KB

Download
memory/3376-132-0x00000000000D0000-0x000000000017E000-memory.dmp

Filesize
696KB

Download
memory/3376-133-0x0000000004B00000-0x0000000004B9C000-memory.dmp

Filesize
624KB

Download
memory/3376-134-0x00000000051B0000-0x0000000005754000-memory.dmp

Filesize
5.6MB

Download
memory/3376-135-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/3376-136-0x0000000004BB0000-0x0000000004BBA000-memory.dmp

Filesize
40KB

Download
memory/3376-137-0x0000000004E70000-0x0000000004EC6000-memory.dmp

Filesize
344KB

Download
memory/3492-138-0x0000000000000000-mapping.dmp

Download
memory/4604-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads