agenttesla | f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4

General

Target

f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe
Size

797KB
MD5

a3190726bb65bfb1b862c9b5cfba9622
SHA1

3058a8872a4bdab11e86753eb6c1bf707ed82041
SHA256

f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4
SHA512

05cd7b9b5944e0b009c2ae6e15596d27f2b43a5d9757ef66b85e53a18818a0c8bb4c0ee4681a3f503c2e06a76aaef059ca2924f226ac42dfce48faaff14e12a2
SSDEEP

24576:K65eIvUXOPYcLdcdjE+SAHKOCs6/hkp6uH+n:teGUXOPYcLdc55cbLFuen

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
terminal4.veeblehosting.com
Port:
587
Username:
[email protected]
Password:
Ifeanyi1987@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe

description	pid	process	target process
PID 3684 set thread context of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msbuild.exe

pid process

5104 msbuild.exe
5104 msbuild.exe

pid	process
5104	msbuild.exe
5104	msbuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exemsbuild.exe

description	pid	process
Token: SeDebugPrivilege	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe
Token: SeDebugPrivilege	5104	msbuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe

description	pid	process	target process
PID 3684 wrote to memory of 2720	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	AddInProcess32.exe
PID 3684 wrote to memory of 2720	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	AddInProcess32.exe
PID 3684 wrote to memory of 2720	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	AddInProcess32.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 5104	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 4764	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 4764	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe
PID 3684 wrote to memory of 4764	3684	f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe	msbuild.exe

C:\Users\Admin\AppData\Local\Temp\f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe
"C:\Users\Admin\AppData\Local\Temp\f9a65861c138e4f29a25a134cc250c8bdd49757e6dc9ffec6deb557ab0839fe4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:2720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
2⤵
PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-9-0x00007FF8649C0000-0x00007FF865481000-memory.dmp

Filesize
10.8MB

Download
memory/3684-1-0x00007FF8649C0000-0x00007FF865481000-memory.dmp

Filesize
10.8MB

Download
memory/3684-2-0x0000011B3D000000-0x0000011B3D010000-memory.dmp

Filesize
64KB

Download
memory/3684-3-0x0000011B3CF10000-0x0000011B3CFA6000-memory.dmp

Filesize
600KB

Download
memory/3684-0-0x0000011B3B2A0000-0x0000011B3B2DA000-memory.dmp

Filesize
232KB

Download
memory/5104-8-0x0000000005370000-0x00000000053D6000-memory.dmp

Filesize
408KB

Download
memory/5104-6-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/5104-7-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/5104-5-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/5104-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5104-10-0x0000000006690000-0x00000000066E0000-memory.dmp

Filesize
320KB

Download
memory/5104-11-0x0000000006780000-0x0000000006812000-memory.dmp

Filesize
584KB

Download
memory/5104-12-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/5104-13-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/5104-14-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads