agenttesla | dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f

General

Target

dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
Size

987KB
MD5

3efafe24f34c1b1b7f0c39943a6327d1
SHA1

3c8cfac5575c18d9ffe4a181a629d4c666c77e2e
SHA256

dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f
SHA512

20693c27ccfdfe86ef213148ab994b72c5f3dd179d60dcb72fd0eb1af9893c02cc228d13b3ca6866550ea047662ddc6cfe6532dced9c866bb536079fa93e4a0f
SSDEEP

12288:GUe1E6jD/0LyZX6NsR4hu9rGJ31I+iZxMAW/7AKrm3BTPFhW0fbgndK41155opoE:pe1tD/PZX6nhy031IL7xHJ+Q41Ve

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://discord.com/api/webhooks/1178979343360348200/8srcyWnVPB1bU5zRmsxn6NwwB7kc8tq5vYwH3zqeKSI4TK9S5wTPqoF5Rmm0xCs7rA6A

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

description	pid	process	target process
PID 2420 set thread context of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

pid	process
2368	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
2368	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

description pid process

Token: SeDebugPrivilege 2368 dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

description	pid	process
Token: SeDebugPrivilege	2368	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

description	pid	process	target process
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
PID 2420 wrote to memory of 2368	2420	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe	dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe

C:\Users\Admin\AppData\Local\Temp\dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
"C:\Users\Admin\AppData\Local\Temp\dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2420

C:\Users\Admin\AppData\Local\Temp\dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe
"C:\Users\Admin\AppData\Local\Temp\dfb68130df0836d5b3de13e8a51a9af8946e026923f7d7babfca446d4fdb5b5f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-23-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2368-22-0x0000000001090000-0x00000000010D0000-memory.dmp

Filesize
256KB

Download
memory/2368-21-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2368-19-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2368-24-0x0000000001090000-0x00000000010D0000-memory.dmp

Filesize
256KB

Download
memory/2368-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2420-6-0x0000000004D60000-0x0000000004DDC000-memory.dmp

Filesize
496KB

Download
memory/2420-8-0x0000000000C90000-0x0000000000CD0000-memory.dmp

Filesize
256KB

Download
memory/2420-2-0x0000000000C90000-0x0000000000CD0000-memory.dmp

Filesize
256KB

Download
memory/2420-0-0x00000000010F0000-0x00000000011EC000-memory.dmp

Filesize
1008KB

Download
memory/2420-7-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-20-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-1-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2420-5-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/2420-4-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2420-3-0x0000000000320000-0x0000000000338000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads