agenttesla | 496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686

General

Target

496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe
Size

1.0MB
MD5

9167fdba7412a6714d5362a3281eddd5
SHA1

faeda2c77c905b14a31749117f82770717a7dced
SHA256

496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686
SHA512

c66020878fa37fd130b3cff8726c91380448f071369c0668a78a143bda3b84eb204e27b956fc5c81ff34d9e62fb0ec2c0d91354605510eeb31efbdf6a954bfc6
SSDEEP

12288:ZEK1L8WtogCbvAaUFU28u/gz0R2Jpy0fTS7DXE4jmD/V8vfa77tP+h2s6ZPcAZc9:ZIJYU2V/6pyCOD3jmllPcXV

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.fantashifreighters.co.ke
Port:
587
Username:
[email protected]
Password:
Info@Fantashi2024
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 api.ipify.org
8 api.ipify.org

flow	ioc
7	api.ipify.org
8	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe

description	pid	process	target process
PID 2912 set thread context of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exeInstallUtil.exe

pid	process
2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe
2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe
2368	InstallUtil.exe
2368	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exeInstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe
Token: SeDebugPrivilege	2368	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe

description	pid	process	target process
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe
PID 2912 wrote to memory of 2368	2912	496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe
"C:\Users\Admin\AppData\Local\Temp\496463c7496cccbf2a3b677272ae9e0cd211bccb1363ffececa9e6b976a2b686.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2368-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-23-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2368-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-21-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2368-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2368-24-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-6-0x00000000005F0000-0x000000000060A000-memory.dmp

Filesize
104KB

Download
memory/2912-8-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-2-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-15-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-0-0x000000007423E000-0x000000007423F000-memory.dmp

Filesize
4KB

Download
memory/2912-7-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2912-1-0x0000000000A20000-0x0000000000B28000-memory.dmp

Filesize
1.0MB

Download
memory/2912-5-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-22-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-4-0x000000007423E000-0x000000007423F000-memory.dmp

Filesize
4KB

Download
memory/2912-3-0x0000000002130000-0x0000000002174000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads