agenttesla | 92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528

General

Target

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
Size

832KB
MD5

719d1025c292bfee9c1df6903bb1c3ac
SHA1

d23fe682c242dff7446d9661cb6045e742666ebc
SHA256

92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528
SHA512

1d64abb7b77ed94c8d63a0dddf00b5b00b108ee20c320a8263e83d9bc23013bfeb1e3dbb03b171e3beee03b16111fc9349de2380943d5d960a67f55b94cbb1c1
SSDEEP

24576:EeWtb3BErWwO8+LXvon7qikP22ctGhJHfAAb/F:ENZBErO8+sn1J2sG/HfAAb/F

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
emidco.com
Port:
587
Username:
[email protected]
Password:
DMmpPxx9c
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4700 set thread context of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
1944	MSBuild.exe
1944	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
Token: SeDebugPrivilege	1944	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99
PID 4700 wrote to memory of 1944	4700	92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe	99

C:\Users\Admin\AppData\Local\Temp\92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe
"C:\Users\Admin\AppData\Local\Temp\92aff680ae646607e5d30fd43bfb66d8d765b7bcf7ffc0aacb65c389358fc528.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1944-20-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/1944-19-0x0000000005E50000-0x0000000005EA0000-memory.dmp

Filesize
320KB

Download
memory/1944-18-0x0000000004F10000-0x0000000004F76000-memory.dmp

Filesize
408KB

Download
memory/1944-17-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/1944-15-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4700-10-0x0000000005710000-0x00000000057AC000-memory.dmp

Filesize
624KB

Download
memory/4700-6-0x0000000007BE0000-0x0000000007C02000-memory.dmp

Filesize
136KB

Download
memory/4700-8-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download
memory/4700-9-0x00000000055E0000-0x0000000005662000-memory.dmp

Filesize
520KB

Download
memory/4700-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/4700-11-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/4700-12-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4700-7-0x0000000007BA0000-0x0000000007BAC000-memory.dmp

Filesize
48KB

Download
memory/4700-5-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4700-16-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4700-4-0x0000000002E20000-0x0000000002E2A000-memory.dmp

Filesize
40KB

Download
memory/4700-3-0x0000000007A40000-0x0000000007AD2000-memory.dmp

Filesize
584KB

Download
memory/4700-2-0x0000000007F10000-0x00000000084B4000-memory.dmp

Filesize
5.6MB

Download
memory/4700-1-0x0000000000AA0000-0x0000000000B76000-memory.dmp

Filesize
856KB

Download

Analysis

Sharing