agenttesla | 92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528

General

Target

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
Size

832KB
MD5

719d1025c292bfee9c1df6903bb1c3ac
SHA1

d23fe682c242dff7446d9661cb6045e742666ebc
SHA256

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528
SHA512

1d64abb7b77ed94c8d63a0dddf00b5b00b108ee20c320a8263e83d9bc23013bfeb1e3dbb03b171e3beee03b16111fc9349de2380943d5d960a67f55b94cbb1c1
SSDEEP

24576:EeWtb3BErWwO8+LXvon7qikP22ctGhJHfAAb/F:ENZBErO8+sn1J2sG/HfAAb/F

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
emidco.com
Port:
587
Username:
[email protected]
Password:
DMmpPxx9c
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe

description	pid	process	target process
PID 2456 set thread context of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exeMSBuild.exe

pid	process
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
2652	MSBuild.exe
2652	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
Token: SeDebugPrivilege	2652	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe

description	pid	process	target process
PID 2456 wrote to memory of 2756	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2756	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2756	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2756	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe
PID 2456 wrote to memory of 2652	2456	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
"C:\Users\Admin\AppData\Local\Temp\92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2456-0-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/2456-1-0x0000000000120000-0x00000000001F6000-memory.dmp

Filesize
856KB

Download
memory/2456-2-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2456-3-0x0000000000300000-0x0000000000322000-memory.dmp

Filesize
136KB

Download
memory/2456-4-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download
memory/2456-5-0x0000000000320000-0x0000000000330000-memory.dmp

Filesize
64KB

Download
memory/2456-6-0x0000000004D10000-0x0000000004D92000-memory.dmp

Filesize
520KB

Download
memory/2456-7-0x000000007456E000-0x000000007456F000-memory.dmp

Filesize
4KB

Download
memory/2456-8-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2456-19-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-13-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2652-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-20-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2652-21-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads