agenttesla | eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f

General

Target

eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe
Size

533KB
MD5

1b38c1e6bece1fbfd546f1016a6b17d7
SHA1

d129c05f313c86e9186a7753ffc6e5189d0a84f2
SHA256

eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f
SHA512

8fd05e40c4b4f775b9f1d6b19382d5b8d1424c8bc176c0885c25e8b07174200dc9ba909e4d83dc920e745cd9316fc698242a1d674f805cde9882740b77ec9d1b
SSDEEP

6144:PDMAYloj1/L8YEAQwgG5hRCEdMZpj7Sfav0bI8rd6SlV9RNbPtQN:PDMAzjN4YEAFTC+MaPbI8J6SlTPs

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
box@alscotop.com
Password:
godisgreat

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1100-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1100-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1100-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1100-66-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1100-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1100-71-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

Processes:

InstallUtil.exe

pid process

1100 InstallUtil.exe
Loads dropped DLL 1 IoCs

Processes:

eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe

pid process

544 eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe

pid	process
1100	InstallUtil.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/544-56-0x0000000005070000-0x0000000005098000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe

description	pid	process	target process
PID 544 set thread context of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exeInstallUtil.exe

pid	process
544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe
544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe
1100	InstallUtil.exe
1100	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe
Token: SeDebugPrivilege	1100	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe

description	pid	process	target process
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe
PID 544 wrote to memory of 1100	544	eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe
"C:\Users\Admin\AppData\Local\Temp\eed1ff326beb0779b3fefef65ca73bec04723ccc72db283557aa6a73a28a3d1f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
memory/544-54-0x0000000000F20000-0x0000000000FAC000-memory.dmp

Filesize
560KB

Download
memory/544-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/544-56-0x0000000005070000-0x0000000005098000-memory.dmp

Filesize
160KB

Download
memory/544-57-0x0000000000B50000-0x0000000000B64000-memory.dmp

Filesize
80KB

Download
memory/544-58-0x0000000000910000-0x0000000000916000-memory.dmp

Filesize
24KB

Download
memory/1100-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1100-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1100-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1100-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1100-66-0x00000000004374CE-mapping.dmp

Download
memory/1100-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1100-71-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1100-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads