agenttesla | abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf

General

Target

abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
Size

711KB
MD5

6d7ab51f29fe449b4c249f62d355d52f
SHA1

a4e62f570bf0ee178f062bc3d5ac2c8a240ac742
SHA256

abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf
SHA512

4c720f4a60aef2a57e75990db381b5fb6822765e8ebb0ff14756e1ed56c6e19782d5da4918502dd36dc0178b96edcc3791a2d1f9f8f41a9ecae764d91bc54208
SSDEEP

12288:cvXiAEfDRUu4UWFhtYho/uR7+dB9o3dbD/wRxJy2eoYXCRh7AHb5v:eRE7wUqhQo2RwoN6DeRHl

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
hormonelab.com.pk
Port:
587
Username:
[email protected]
Password:
NoT9&Gdkc%4^
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
5108	MSBuild.exe
5108	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
Token: SeDebugPrivilege	5108	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100
PID 2092 wrote to memory of 5108	2092	abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe	100

C:\Users\Admin\AppData\Local\Temp\abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe
"C:\Users\Admin\AppData\Local\Temp\abfe626dee6ff3c8fcb5c7b6f4cccdc17e23252280dadae3d6177db35410aabf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-10-0x0000000009120000-0x00000000091BC000-memory.dmp

Filesize
624KB

Download
memory/2092-1-0x00000000007F0000-0x00000000008A6000-memory.dmp

Filesize
728KB

Download
memory/2092-2-0x0000000005850000-0x0000000005DF4000-memory.dmp

Filesize
5.6MB

Download
memory/2092-3-0x00000000052A0000-0x0000000005332000-memory.dmp

Filesize
584KB

Download
memory/2092-4-0x0000000005350000-0x000000000535A000-memory.dmp

Filesize
40KB

Download
memory/2092-5-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2092-6-0x0000000006B00000-0x0000000006B1C000-memory.dmp

Filesize
112KB

Download
memory/2092-7-0x0000000006510000-0x000000000651E000-memory.dmp

Filesize
56KB

Download
memory/2092-9-0x0000000006B20000-0x0000000006BA2000-memory.dmp

Filesize
520KB

Download
memory/2092-8-0x0000000006550000-0x0000000006566000-memory.dmp

Filesize
88KB

Download
memory/2092-12-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2092-11-0x00000000749DE000-0x00000000749DF000-memory.dmp

Filesize
4KB

Download
memory/2092-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

Filesize
4KB

Download
memory/2092-17-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/5108-15-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/5108-16-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/5108-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5108-18-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/5108-19-0x0000000006760000-0x00000000067B0000-memory.dmp

Filesize
320KB

Download
memory/5108-20-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing