agenttesla | 368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0

General

Target

368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
Size

520KB
MD5

08f218cdd162caa4d9aed580f78bc31e
SHA1

8a02a81c636847e38be6de2aca2374887a6f2727
SHA256

368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0
SHA512

9fa5116080bc6b6e7eead09a878a8cfe4ee78bd4ac403742eba7b535425cbafbc002b6d7de23b31876be41b6119e41c68fb0e89675087f96392594584f184db0
SSDEEP

12288:Qdqczp/SJjf2LjSt+qDLdlXCORQU7ZvmplwB5j0UE/jUo3n+2L:6pqJzZ1SOGUIgr09/j33+

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.sturmsgroup.com
Port:
587
Username:
[email protected]
Password:
1nxez&C#vfZ6#0Jp
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

Processes:

368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

description	pid	process	target process
PID 2976 set thread context of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

pid	process
1680	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
1680	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

description	pid	process
Token: SeDebugPrivilege	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
Token: SeDebugPrivilege	1680	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

description	pid	process	target process
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
PID 2976 wrote to memory of 1680	2976	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe	368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe

C:\Users\Admin\AppData\Local\Temp\368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
"C:\Users\Admin\AppData\Local\Temp\368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
C:\Users\Admin\AppData\Local\Temp\368e9c716c72cb9cedfd73566ab70cfa6e311d67c6c347ce59d03d65142f2ec0.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

3

T1552

Credentials In Files

3

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1680-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1680-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1680-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1680-21-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/1680-20-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/1680-18-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1680-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1680-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1680-22-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/1680-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2976-2-0x0000000004960000-0x00000000049A0000-memory.dmp

Filesize
256KB

Download
memory/2976-0-0x0000000000B10000-0x0000000000B98000-memory.dmp

Filesize
544KB

Download
memory/2976-1-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2976-6-0x0000000004290000-0x00000000042DC000-memory.dmp

Filesize
304KB

Download
memory/2976-5-0x0000000001FA0000-0x0000000001FE0000-memory.dmp

Filesize
256KB

Download
memory/2976-19-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2976-4-0x0000000000AC0000-0x0000000000B00000-memory.dmp

Filesize
256KB

Download
memory/2976-3-0x00000000043E0000-0x0000000004438000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads