agenttesla | d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b

General

Target

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
Size

686KB
MD5

4722e3705add9e648eaf1f788c8c9220
SHA1

5a4eb65768b2f7ba0636c037bb4fbf5e05033426
SHA256

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b
SHA512

3f246b4f7b71246ce85cb0371a50c52284c7edc13c6334573c15a93cf5d59eb293fdc581fcf523b06fd7544d60ec2d5c3412f0cc03c7d67b0a9bb80a9ec0f9e8
SSDEEP

12288:kDsx504bFSAwUz0cxhuc6cSIGuAyHFMahI6i3Je3xScQ8:Msw4bkQ0auc6NBYMkI60Je3XQ8

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.actionba.com
Port:
587
Username:
[email protected]
Password:
CharmantR.AB2023
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe

description	pid	process	target process
PID 4356 set thread context of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exeMSBuild.exe

pid	process
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
3132	MSBuild.exe
3132	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
Token: SeDebugPrivilege	3132	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe

description	pid	process	target process
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe
PID 4356 wrote to memory of 3132	4356	d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe
"C:\Users\Admin\AppData\Local\Temp\d64299e50b90d5cd5fa28b0c0764d4cb7cd4c0a35325b935155b5b4692dc2a2b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3132-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3132-19-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3132-18-0x0000000006690000-0x00000000066E0000-memory.dmp

Filesize
320KB

Download
memory/3132-17-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/3132-16-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/3132-15-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-4-0x0000000005260000-0x000000000526A000-memory.dmp

Filesize
40KB

Download
memory/4356-7-0x00000000062B0000-0x00000000062C0000-memory.dmp

Filesize
64KB

Download
memory/4356-8-0x0000000007DE0000-0x0000000007E62000-memory.dmp

Filesize
520KB

Download
memory/4356-9-0x000000000A560000-0x000000000A5FC000-memory.dmp

Filesize
624KB

Download
memory/4356-10-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/4356-11-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-6-0x0000000007CC0000-0x0000000007CDA000-memory.dmp

Filesize
104KB

Download
memory/4356-14-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-5-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4356-0-0x000000007484E000-0x000000007484F000-memory.dmp

Filesize
4KB

Download
memory/4356-3-0x00000000050A0000-0x0000000005132000-memory.dmp

Filesize
584KB

Download
memory/4356-2-0x0000000005700000-0x0000000005CA4000-memory.dmp

Filesize
5.6MB

Download
memory/4356-1-0x0000000000610000-0x00000000006C2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads