agenttesla | 5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1

General

Target

LATEST RATE.exe
Size

1.1MB
MD5

5b1f4e2b1ae240311980d2f6186cf88e
SHA1

36e0e9c15f9d21c9ecbd40ac3bdf03ab34245c82
SHA256

5da1b3537b33feef0da4adcc435e682b875de40a6e3ce1024a6c5e483bda8ff1
SHA512

42db37dbf80ce648f72e7afcb8be38b9c81c30e366531d913b9e690c69312d551ef217e343a8810e1c024124cc516df9108ecb299533357ad818e20bd1ab2162
SSDEEP

12288:zWHNC1Q/rusz7NxS+Q7+GvwP2FAihZ+YBtskhYT75geR5Of6oAGGomaJQWRu125X:sLGHK5EGjtWo1raPMVu

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.mibmglobal.com
Port:
587
Username:
[email protected]
Password:
mibmg3010!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

LATEST RATE.exe

description pid process target process

PID 1524 set thread context of 776 1524 LATEST RATE.exe Setup.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1680 776 WerFault.exe Setup.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

LATEST RATE.exe

pid process

1524 LATEST RATE.exe
1524 LATEST RATE.exe
1524 LATEST RATE.exe
1524 LATEST RATE.exe
1524 LATEST RATE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

LATEST RATE.exe

description pid process

Token: SeDebugPrivilege 1524 LATEST RATE.exe

description	pid	process	target process
PID 1524 set thread context of 776	1524	LATEST RATE.exe	Setup.exe

pid	pid_target	process	target process
1680	776	WerFault.exe	Setup.exe

pid	process
1524	LATEST RATE.exe
1524	LATEST RATE.exe
1524	LATEST RATE.exe
1524	LATEST RATE.exe
1524	LATEST RATE.exe

description	pid	process
Token: SeDebugPrivilege	1524	LATEST RATE.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

LATEST RATE.exeSetup.exe

description	pid	process	target process
PID 1524 wrote to memory of 868	1524	LATEST RATE.exe	aspnet_wp.exe
PID 1524 wrote to memory of 868	1524	LATEST RATE.exe	aspnet_wp.exe
PID 1524 wrote to memory of 868	1524	LATEST RATE.exe	aspnet_wp.exe
PID 1524 wrote to memory of 856	1524	LATEST RATE.exe	InstallUtil.exe
PID 1524 wrote to memory of 856	1524	LATEST RATE.exe	InstallUtil.exe
PID 1524 wrote to memory of 856	1524	LATEST RATE.exe	InstallUtil.exe
PID 1524 wrote to memory of 1744	1524	LATEST RATE.exe	aspnet_regbrowsers.exe
PID 1524 wrote to memory of 1744	1524	LATEST RATE.exe	aspnet_regbrowsers.exe
PID 1524 wrote to memory of 1744	1524	LATEST RATE.exe	aspnet_regbrowsers.exe
PID 1524 wrote to memory of 1092	1524	LATEST RATE.exe	Microsoft.Workflow.Compiler.exe
PID 1524 wrote to memory of 1092	1524	LATEST RATE.exe	Microsoft.Workflow.Compiler.exe
PID 1524 wrote to memory of 1092	1524	LATEST RATE.exe	Microsoft.Workflow.Compiler.exe
PID 1524 wrote to memory of 728	1524	LATEST RATE.exe	DataSvcUtil.exe
PID 1524 wrote to memory of 728	1524	LATEST RATE.exe	DataSvcUtil.exe
PID 1524 wrote to memory of 728	1524	LATEST RATE.exe	DataSvcUtil.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 1524 wrote to memory of 776	1524	LATEST RATE.exe	Setup.exe
PID 776 wrote to memory of 1680	776	Setup.exe	WerFault.exe
PID 776 wrote to memory of 1680	776	Setup.exe	WerFault.exe
PID 776 wrote to memory of 1680	776	Setup.exe	WerFault.exe
PID 776 wrote to memory of 1680	776	Setup.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\LATEST RATE.exe
"C:\Users\Admin\AppData\Local\Temp\LATEST RATE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:1744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 304
    3⤵
    - Program crash
    PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1524-54-0x0000000000F30000-0x0000000001056000-memory.dmp

Filesize
1.1MB

Download
memory/1524-55-0x000000001B150000-0x000000001B1D0000-memory.dmp

Filesize
512KB

Download
memory/1524-56-0x0000000000EB0000-0x0000000000F1E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads