agenttesla | 9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381

General

Target

9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe
Size

611KB
MD5

9f9649b0714277976f0822ae1be59945
SHA1

2a29167fd80d8d0f767921f1b6d33c2e05fb0416
SHA256

9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381
SHA512

0c1030926a2cbda68e44a2a664ed9ba145f0e4368fbb029011724d1b8c9a07d7aab65c940363a836784675602446b87d83e40483f8fc08b841be0b305b7e3bf3
SSDEEP

12288:8DuCvpgyBs4BibBAjAkgHmMCwMqSbvXWtWJVaN8BcPr2e1aXzsnt:8DuCvpls4g/kgPqTbvXWguNGir2e1AWt

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
terminal4.veeblehosting.com
Port:
587
Username:
[email protected]
Password:
Ifeanyi1987@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe

description	pid	process	target process
PID 2524 set thread context of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

installutil.exe

pid process

2532 installutil.exe
2532 installutil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

installutil.exe

description pid process

Token: SeDebugPrivilege 2532 installutil.exe

pid	process
2532	installutil.exe
2532	installutil.exe

description	pid	process
Token: SeDebugPrivilege	2532	installutil.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe

description	pid	process	target process
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2532	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	installutil.exe
PID 2524 wrote to memory of 2652	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	WerFault.exe
PID 2524 wrote to memory of 2652	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	WerFault.exe
PID 2524 wrote to memory of 2652	2524	9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe
"C:\Users\Admin\AppData\Local\Temp\9b6dc9a0168aa5b6672b6e33a93143c6ef56751710b7786a6839c09860bd2381.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2524 -s 668
2⤵
PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-0-0x0000000000E80000-0x0000000000E8A000-memory.dmp

Filesize
40KB

Download
memory/2524-1-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2524-2-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download
memory/2524-3-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/2524-4-0x0000000000A40000-0x0000000000AD6000-memory.dmp

Filesize
600KB

Download
memory/2524-18-0x000000001B2A0000-0x000000001B320000-memory.dmp

Filesize
512KB

Download
memory/2524-17-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

Filesize
9.9MB

Download
memory/2532-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2532-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-15-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-16-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download
memory/2532-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2532-19-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2532-20-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing