agenttesla | e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a

General

Target

e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
Size

811KB
MD5

dc9d9448caee4e71e1a5c4df0d685924
SHA1

d3161da375478a4f3f72249d920d19b7017dc395
SHA256

e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a
SHA512

308ad252b1c7738c9dad45491770291d755214465dccf399b99d70770c999ab36bfdc90010ed94f3a64f8c333ddedbcd5d19e9c04efa488e7ef18d7412434d78
SSDEEP

24576:S34/up+pJyPwC3OsLRCpN1dVrtHFMqP+:S38PJawsJRalVjLP+

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6813483585:AAGuo7_iQaYrqOce8KYO5QCqhLeR8nk_gNQ/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

description	pid	process	target process
PID 3876 set thread context of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

pid	process
4876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
4876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
4876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

description pid process

Token: SeDebugPrivilege 4876 e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

description	pid	process
Token: SeDebugPrivilege	4876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

description	pid	process	target process
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
PID 3876 wrote to memory of 4876	3876	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe	e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe

C:\Users\Admin\AppData\Local\Temp\e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
"C:\Users\Admin\AppData\Local\Temp\e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Local\Temp\e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe
"C:\Users\Admin\AppData\Local\Temp\e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2236

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e99e93f8216404e47006857d10ac15ed817d9335700c421670526f0d40ed265a.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/2484-37-0x00000233320A0000-0x00000233320B0000-memory.dmp

Filesize
64KB

Download
memory/2484-21-0x0000023331FA0000-0x0000023331FB0000-memory.dmp

Filesize
64KB

Download
memory/2484-53-0x000002333A410000-0x000002333A411000-memory.dmp

Filesize
4KB

Download
memory/2484-55-0x000002333A440000-0x000002333A441000-memory.dmp

Filesize
4KB

Download
memory/2484-57-0x000002333A550000-0x000002333A551000-memory.dmp

Filesize
4KB

Download
memory/2484-56-0x000002333A440000-0x000002333A441000-memory.dmp

Filesize
4KB

Download
memory/3876-8-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/3876-7-0x0000000005490000-0x0000000005498000-memory.dmp

Filesize
32KB

Download
memory/3876-9-0x00000000064D0000-0x000000000654A000-memory.dmp

Filesize
488KB

Download
memory/3876-10-0x0000000006160000-0x00000000061FC000-memory.dmp

Filesize
624KB

Download
memory/3876-6-0x0000000005450000-0x0000000005468000-memory.dmp

Filesize
96KB

Download
memory/3876-0-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3876-5-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

Filesize
40KB

Download
memory/3876-15-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3876-4-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

Filesize
64KB

Download
memory/3876-3-0x0000000004E10000-0x0000000004EA2000-memory.dmp

Filesize
584KB

Download
memory/3876-2-0x00000000054B0000-0x0000000005A54000-memory.dmp

Filesize
5.6MB

Download
memory/3876-1-0x0000000000370000-0x0000000000440000-memory.dmp

Filesize
832KB

Download
memory/4876-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4876-20-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/4876-19-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/4876-18-0x00000000057B0000-0x0000000005800000-memory.dmp

Filesize
320KB

Download
memory/4876-17-0x0000000004FA0000-0x0000000005006000-memory.dmp

Filesize
408KB

Download
memory/4876-16-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/4876-14-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads