agenttesla | d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b

General

Target

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
Size

686KB
MD5

4722e3705add9e648eaf1f788c8c9220
SHA1

5a4eb65768b2f7ba0636c037bb4fbf5e05033426
SHA256

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b
SHA512

3f246b4f7b71246ce85cb0371a50c52284c7edc13c6334573c15a93cf5d59eb293fdc581fcf523b06fd7544d60ec2d5c3412f0cc03c7d67b0a9bb80a9ec0f9e8
SSDEEP

12288:kDsx504bFSAwUz0cxhuc6cSIGuAyHFMahI6i3Je3xScQ8:Msw4bkQ0auc6NBYMkI60Je3XQ8

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.actionba.com
Port:
587
Username:
[email protected]
Password:
CharmantR.AB2023
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe

description	pid	process	target process
PID 2856 set thread context of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exeMSBuild.exe

pid	process
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
2688	MSBuild.exe
2688	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
Token: SeDebugPrivilege	2688	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe

description	pid	process	target process
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 2856 wrote to memory of 2688	2856	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
"C:\Users\Admin\AppData\Local\Temp\d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2688-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-14-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2688-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-21-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-20-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-23-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2688-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2688-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2856-5-0x0000000005B80000-0x0000000005C02000-memory.dmp

Filesize
520KB

Download
memory/2856-7-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-22-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-6-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/2856-0-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/2856-1-0x0000000001170000-0x0000000001222000-memory.dmp

Filesize
712KB

Download
memory/2856-4-0x0000000001150000-0x0000000001160000-memory.dmp

Filesize
64KB

Download
memory/2856-3-0x0000000000C80000-0x0000000000C9A000-memory.dmp

Filesize
104KB

Download
memory/2856-2-0x0000000074650000-0x0000000074D3E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads