agenttesla | fe53ffe55e2681c889f0ef442a6a75d18a5a445e41cfd6c8cdfaebb7ab49909a

General

Target

c1333252ecbfb02c0987b32e9b8dfe1d.exe
Size

1.5MB
MD5

c1333252ecbfb02c0987b32e9b8dfe1d
SHA1

22fdd57439f0f40be3ae26e223706f363d448d21
SHA256

fe53ffe55e2681c889f0ef442a6a75d18a5a445e41cfd6c8cdfaebb7ab49909a
SHA512

5b63e15ffc5ce939c239e5ce4da415ef835f7503bc67792f4f3f8ef8e47d2bd9e5bedf00f32d981e040488acc7cee4e0fd0d84cd0263aea64b6595d586b8dead
SSDEEP

24576:7Yci8Dgh24pfGjCaKD9Ra4v2z5B6EOZZS5R0:7e8kh24QWaK/aDz58EO3B

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.epaindemgroup.com
Port:
587
Username:
[email protected]
Password:
uur0bhYc

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 7 IoCs

resource	yara_rule
behavioral1/memory/2568-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2568-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2568-16-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2568-18-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2568-20-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2568-23-0x00000000004A0000-0x00000000004E0000-memory.dmp	family_agenttesla
behavioral1/memory/2568-27-0x00000000004A0000-0x00000000004E0000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2568	c1333252ecbfb02c0987b32e9b8dfe1d.exe
2568	c1333252ecbfb02c0987b32e9b8dfe1d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2568	c1333252ecbfb02c0987b32e9b8dfe1d.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2040 wrote to memory of 2568	2040	c1333252ecbfb02c0987b32e9b8dfe1d.exe	28
PID 2568 wrote to memory of 2712	2568	c1333252ecbfb02c0987b32e9b8dfe1d.exe	31
PID 2568 wrote to memory of 2712	2568	c1333252ecbfb02c0987b32e9b8dfe1d.exe	31
PID 2568 wrote to memory of 2712	2568	c1333252ecbfb02c0987b32e9b8dfe1d.exe	31
PID 2568 wrote to memory of 2712	2568	c1333252ecbfb02c0987b32e9b8dfe1d.exe	31

C:\Users\Admin\AppData\Local\Temp\c1333252ecbfb02c0987b32e9b8dfe1d.exe
"C:\Users\Admin\AppData\Local\Temp\c1333252ecbfb02c0987b32e9b8dfe1d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\c1333252ecbfb02c0987b32e9b8dfe1d.exe
  "C:\Users\Admin\AppData\Local\Temp\c1333252ecbfb02c0987b32e9b8dfe1d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 520
    3⤵
    PID:2712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-0-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-1-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download
memory/2040-2-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-4-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download
memory/2040-3-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2040-5-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download
memory/2040-21-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2568-22-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2568-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2568-16-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2568-18-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2568-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2568-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2568-23-0x00000000004A0000-0x00000000004E0000-memory.dmp

Filesize
256KB

Download
memory/2568-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2568-24-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-27-0x00000000004A0000-0x00000000004E0000-memory.dmp

Filesize
256KB

Download
memory/2568-26-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2712-25-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing