agenttesla | 23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084

General

Target

23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
Size

699KB
MD5

1c410acb19dfe18e46307b3c3a6db78d
SHA1

b550ae491304eb9d05ef9e696d6d0cc7777ab5f0
SHA256

23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084
SHA512

efadf23714c929ccefd0ef3df24c515a1122ee1fca35eb8e21f316ea3fdaf25f141778399207559a855ce306a2c8a5802e17209f92ad0199d2b60542e2e12f46
SSDEEP

12288:gjmAXYMjhvPie/rByY7777777777777hcuI8QUfg5A1waTmMg/ZNGl7qU1JetT5q:gjmAXYMFniyygrI8Au1XkGhqU1JAUq76

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
luyanzi.ac.ug
Port:
587
Username:
[email protected]
Password:
info@lit!!!
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4448 set thread context of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
2136	MSBuild.exe
2136	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
Token: SeDebugPrivilege	2136	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90
PID 4448 wrote to memory of 2136	4448	23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe	90

C:\Users\Admin\AppData\Local\Temp\23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe
"C:\Users\Admin\AppData\Local\Temp\23f0c7bb78b058b5a7ca25c6e8ab0942a27694e39a7732a112d5384d372fb084.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2136-20-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/2136-19-0x00000000067F0000-0x0000000006840000-memory.dmp

Filesize
320KB

Download
memory/2136-18-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/2136-17-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/2136-15-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-10-0x0000000009410000-0x00000000094AC000-memory.dmp

Filesize
624KB

Download
memory/4448-6-0x0000000005C30000-0x0000000005C50000-memory.dmp

Filesize
128KB

Download
memory/4448-8-0x0000000006920000-0x0000000006936000-memory.dmp

Filesize
88KB

Download
memory/4448-9-0x0000000006D90000-0x0000000006E12000-memory.dmp

Filesize
520KB

Download
memory/4448-0-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/4448-11-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/4448-12-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-7-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/4448-5-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-16-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-4-0x0000000005700000-0x000000000570A000-memory.dmp

Filesize
40KB

Download
memory/4448-3-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/4448-2-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/4448-1-0x0000000000C40000-0x0000000000CF6000-memory.dmp

Filesize
728KB

Download

Analysis

Sharing