agenttesla | 7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c

General

Target

7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe
Size

735KB
MD5

bf55b803ed8f7fe4ffeced1f67e24831
SHA1

e69c40ad8fcf908ed50c8f14e03b2b0e4409df9b
SHA256

7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c
SHA512

1332b458dd3a50ee1e9ccf30f3a590fcca54ee8a60ec83672e35ec569eb5a775031c0c1bd7b179051d97bb412feb7adbd38410bda1ae33f58c40dbf90cc796a4
SSDEEP

12288:BIejJLbois3QZTLdgdNaGO1Dk/9/BDxj+Xr2yJJPL9z79I4sj7vKEiW:XjJLb1+uLdgdNyIF/BFyLTLXs

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ionos.es
Port:
587
Username:
[email protected]
Password:
ReparaHogar2013
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs

resource	yara_rule
behavioral2/memory/4500-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_EXE_Packed_GEN01

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/4500-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/4500-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4500-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4500-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/4500-14-0x0000000000400000-0x0000000000440000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe
2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe
2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe
2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe
4500	InstallUtil.exe
4500	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe
Token: SeDebugPrivilege	4500	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 2208	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	100
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102
PID 2608 wrote to memory of 4500	2608	7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe	102

C:\Users\Admin\AppData\Local\Temp\7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe
"C:\Users\Admin\AppData\Local\Temp\7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-10-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2608-11-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2608-2-0x0000000005040000-0x00000000050DC000-memory.dmp

Filesize
624KB

Download
memory/2608-3-0x0000000005690000-0x0000000005C34000-memory.dmp

Filesize
5.6MB

Download
memory/2608-4-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2608-5-0x00000000055E0000-0x0000000005624000-memory.dmp

Filesize
272KB

Download
memory/2608-6-0x0000000005DE0000-0x0000000005E72000-memory.dmp

Filesize
584KB

Download
memory/2608-7-0x0000000005D70000-0x0000000005D7A000-memory.dmp

Filesize
40KB

Download
memory/2608-8-0x0000000004FA0000-0x0000000004FB0000-memory.dmp

Filesize
64KB

Download
memory/2608-12-0x00000000061B0000-0x00000000061CA000-memory.dmp

Filesize
104KB

Download
memory/2608-1-0x0000000000F60000-0x000000000101E000-memory.dmp

Filesize
760KB

Download
memory/2608-0-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2608-9-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/2608-13-0x0000000006200000-0x0000000006206000-memory.dmp

Filesize
24KB

Download
memory/2608-19-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4500-16-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4500-17-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/4500-18-0x00000000055D0000-0x0000000005636000-memory.dmp

Filesize
408KB

Download
memory/4500-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4500-20-0x0000000006340000-0x0000000006390000-memory.dmp

Filesize
320KB

Download
memory/4500-21-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/4500-22-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing