agenttesla | 1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b

General

Target

1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
Size

658KB
MD5

18c5fc41e92b862a2771cf3186b40d73
SHA1

58ae3ac6fab06f9b4be827fd2cec525ee5ca24c1
SHA256

1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b
SHA512

bbf8adcf9fa73274203f8c06a86aaf874bf948e0ad29dd10cde5797e615227613333b13538a5d2e77e1aa23d18e2d980fbba75d92ba6f94c7d540da908518629
SSDEEP

12288:JlYifTfO6AoN0P/hqszanaC5JgJ0mCuFLTYdyhrN6hFc0eBiVEmSbfrZYFDV:EirO6Aofs2oJ6WDZNCFc0esVZSvw

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
srv.masternic.net
Port:
587
Username:
[email protected]
Password:
-H{2Szxi!%qb
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe

description	pid	process	target process
PID 992 set thread context of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exeMSBuild.exe

pid	process
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
2564	MSBuild.exe
2564	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
Token: SeDebugPrivilege	2564	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe

description	pid	process	target process
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe
PID 992 wrote to memory of 2564	992	1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe
"C:\Users\Admin\AppData\Local\Temp\1dbe374c6c753a47e06ea8a5b3e9241eee7ec31d0b81b2764cf7105c3300be1b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/992-1-0x0000000001020000-0x00000000010CA000-memory.dmp

Filesize
680KB

Download
memory/992-2-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/992-3-0x0000000000A00000-0x0000000000A1A000-memory.dmp

Filesize
104KB

Download
memory/992-4-0x0000000000380000-0x0000000000390000-memory.dmp

Filesize
64KB

Download
memory/992-5-0x0000000004D90000-0x0000000004E12000-memory.dmp

Filesize
520KB

Download
memory/992-6-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/992-7-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/992-21-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2564-14-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2564-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-20-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2564-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2564-22-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2564-23-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads