agenttesla | 93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a

General

Target

93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe
Size

776KB
MD5

5f5007d479284c637ee7af9ecf085ff9
SHA1

b1d249b76d71b5486453ee088a30ab66398e1f74
SHA256

93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a
SHA512

899106d3a206d55ae94b2775c38c59a29db47a55e42da1bd9eae28afe3099193812a863e62d1f2a6f3afcfef7137f4c2ca0955c95f271197aae1bd502845b051
SSDEEP

6144:qD2v7gkRvi3Kg4B1Rj7XvlczaB2DH2wMZgIaBI72xxaT+DSmKaWMueU+JqV3pDT/:werNJSsZgVm2WCD1KtMuL+J8VSpto

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
box@alscotop.com
Password:
godisgreat

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1952-63-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/1952-64-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/1952-66-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1952-68-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/1952-69-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/1952-73-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla
behavioral1/memory/1952-76-0x0000000000090000-0x00000000000CC000-memory.dmp	family_agenttesla

Executes dropped EXE 1 IoCs

Processes:

InstallUtil.exe

pid process

1952 InstallUtil.exe
Loads dropped DLL 1 IoCs

Processes:

93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe

pid process

1228 93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe

pid	process
1952	InstallUtil.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1228-56-0x0000000000B70000-0x0000000000B98000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe

description	pid	process	target process
PID 1228 set thread context of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exeInstallUtil.exe

pid	process
1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe
1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe
1952	InstallUtil.exe
1952	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe
Token: SeDebugPrivilege	1952	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe

description	pid	process	target process
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe
PID 1228 wrote to memory of 1952	1228	93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe
"C:\Users\Admin\AppData\Local\Temp\93caf26ccb41093ce2efaac4631c354b9a69e5da6bc71e3fa1bd84a531603b8a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
memory/1228-54-0x0000000000C80000-0x0000000000D48000-memory.dmp

Filesize
800KB

Download
memory/1228-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1228-56-0x0000000000B70000-0x0000000000B98000-memory.dmp

Filesize
160KB

Download
memory/1228-57-0x0000000000820000-0x0000000000834000-memory.dmp

Filesize
80KB

Download
memory/1228-58-0x0000000000940000-0x0000000000946000-memory.dmp

Filesize
24KB

Download
memory/1952-63-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1952-64-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1952-66-0x00000000004374CE-mapping.dmp

Download
memory/1952-61-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1952-68-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1952-69-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1952-73-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1952-76-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download
memory/1952-60-0x0000000000090000-0x00000000000CC000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads