agenttesla | 861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1

General

Target

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
Size

720KB
MD5

042e7c28f1bdf5bd7eb6c050a18bde92
SHA1

bde9069ebcecd98751e66655aa11401c29731dbd
SHA256

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1
SHA512

b1ed1fa6ad1c0461da28450b174dbdda2f7c3981533bc1dbd06128a8a79321a744447419e69cf236812b6f2d9f2f038e2aea7acd3b08cb6d85cf51e2ddaea701
SSDEEP

12288:MXmkpZX2jjeh+8DVWJBtESRr2DTSVKjAiSGVHWeh3ih9HXA:AZmeh9WJIi1ojAiBVHBYTQ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5056459562:AAHQW9wJvHEkQsnxuML0xV3IDA6-DUuUNFI/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/768-63-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/768-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/768-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/768-66-0x00000000004370BE-mapping.dmp	family_agenttesla
behavioral1/memory/768-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/768-70-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

description	pid	process	target process
PID 2040 set thread context of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

pid	process
2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
768	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
768	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

description	pid	process
Token: SeDebugPrivilege	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
Token: SeDebugPrivilege	768	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
"C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:1504
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  PID:376
- C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
  "C:\Users\Admin\AppData\Local\Temp\861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-64-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-63-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-70-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-68-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-66-0x00000000004370BE-mapping.dmp

Download
memory/768-61-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-60-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2040-55-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download
memory/2040-54-0x00000000001C0000-0x000000000027A000-memory.dmp

Filesize
744KB

Download
memory/2040-59-0x0000000004300000-0x000000000433E000-memory.dmp

Filesize
248KB

Download
memory/2040-58-0x0000000004C60000-0x0000000004CD6000-memory.dmp

Filesize
472KB

Download
memory/2040-57-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/2040-56-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download

description	pid	process	target process
PID 2040 wrote to memory of 1120	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 1120	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 1120	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 1120	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 1504	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 1504	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 1504	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 1504	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 376	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 376	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 376	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 376	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe
PID 2040 wrote to memory of 768	2040	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe	861b16dbb63eac1a7b1256018679e88a7a7434491f86d3ab8fb664cbb03874e1.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads