agenttesla | 5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654

General

Target

5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
Size

806KB
MD5

bc8d05282f5391242f19219dc1e5bf4e
SHA1

afcfb05fd2e809bb5e120297619e2e7a36797398
SHA256

5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654
SHA512

652556e8ec1533b324f7c2260aff7ebf61b8468a911093e083adf261f894201f387200aaa3847964d1bdba2802039da2d1ad5440e4d4453b188af52034a0d2ee
SSDEEP

12288:+tKE6jD/62iNG5nF8ybpfSC4Z4nJgg6wJFNtduLfWiLQi+5RjNGDh2kN0oZJ:+tKtD/61IGZ4nJy8NtsfWivkadRJ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6471053992:AAFUlrUxhi5Jrpjikoc-P4r9ZbsXV_T9vj8/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

description	pid	process	target process
PID 2236 set thread context of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2548 3052 WerFault.exe 5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

pid	pid_target	process	target process
2548	3052	WerFault.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

pid	process
2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
3052	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
3052	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

description	pid	process
Token: SeDebugPrivilege	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
Token: SeDebugPrivilege	3052	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe

description	pid	process	target process
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 2236 wrote to memory of 3052	2236	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
PID 3052 wrote to memory of 2548	3052	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	WerFault.exe
PID 3052 wrote to memory of 2548	3052	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	WerFault.exe
PID 3052 wrote to memory of 2548	3052	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	WerFault.exe
PID 3052 wrote to memory of 2548	3052	5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
"C:\Users\Admin\AppData\Local\Temp\5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236

C:\Users\Admin\AppData\Local\Temp\5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe
"C:\Users\Admin\AppData\Local\Temp\5caa8572425248f5dad8a265a2131eb5a6e72360cd9a489a21d9c8f6e37fc654.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1404
3⤵
- Program crash
PID:2548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-0-0x00000000013C0000-0x0000000001490000-memory.dmp

Filesize
832KB

Download
memory/2236-1-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/2236-2-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/2236-3-0x00000000007D0000-0x00000000007E8000-memory.dmp

Filesize
96KB

Download
memory/2236-4-0x00000000005B0000-0x00000000005B8000-memory.dmp

Filesize
32KB

Download
memory/2236-5-0x00000000007F0000-0x00000000007FA000-memory.dmp

Filesize
40KB

Download
memory/2236-6-0x0000000004F40000-0x0000000004FBC000-memory.dmp

Filesize
496KB

Download
memory/2236-18-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/3052-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-20-0x0000000000B80000-0x0000000000BC0000-memory.dmp

Filesize
256KB

Download
memory/3052-19-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download
memory/3052-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3052-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-21-0x0000000074040000-0x000000007472E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads