agenttesla | 5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2

General

Target

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
Size

2.8MB
MD5

866d7ea6d629b641da79144a95b929f8
SHA1

46f55b35cbedeaa47a342e84bbecc53c791bf1fc
SHA256

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2
SHA512

b36a5fd13100405e836cf3ff5d72de0a2ec19ac9a332b13014d4c207048d9c1c7148fa16f19bb3224abf01719e94e2a584a0f58f43b85fad6c0903146fdf1c49
SSDEEP

49152:qeVIh937bl8Kaqe7rOsVsjkEPn4D//TM+j4uFEWnDEYTC77KommOtWdSXt8Gj:qeVsaKgbAn4D//IcbF/nDLTCHKomXyOF

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6940767976:AAEh_SwiKBJ04TyNZIrvXVlVIhsjEJabqkA/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

41 api.ipify.org
42 api.ipify.org

flow	ioc
41	api.ipify.org
42	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe

description	pid	process	target process
PID 2808 set thread context of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2076 2360 WerFault.exe AddInProcess32.exe

pid	pid_target	process	target process
2076	2360	WerFault.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exeAddInProcess32.exe

pid	process
2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
2360	AddInProcess32.exe
2360	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exeAddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
Token: SeDebugPrivilege	2360	AddInProcess32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe

description	pid	process	target process
PID 2808 wrote to memory of 3460	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	CasPol.exe
PID 2808 wrote to memory of 3460	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	CasPol.exe
PID 2808 wrote to memory of 3460	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	CasPol.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
"C:\Users\Admin\AppData\Local\Temp\5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
PID:3460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 1972
3⤵
- Program crash
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2360 -ip 2360
1⤵
PID:3112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2360-15-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2360-14-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/2360-13-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/2360-12-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2808-3-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/2808-6-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Filesize
64KB

Download
memory/2808-7-0x0000000005910000-0x000000000591A000-memory.dmp

Filesize
40KB

Download
memory/2808-8-0x0000000006420000-0x0000000006536000-memory.dmp

Filesize
1.1MB

Download
memory/2808-5-0x0000000005960000-0x00000000059F2000-memory.dmp

Filesize
584KB

Download
memory/2808-11-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2808-4-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/2808-0-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2808-2-0x0000000005710000-0x000000000572A000-memory.dmp

Filesize
104KB

Download
memory/2808-1-0x0000000000B50000-0x0000000000E20000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads