agenttesla | b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f

General

Target

b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
Size

759KB
MD5

8a8ee72b3364a3893a38bb898c6257fe
SHA1

7139ba139b89bdf3c003862411f93ef85469b99c
SHA256

b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f
SHA512

ad7a7e669638cb66c0f069ed943ca4eba82c24b022fa68285e336098f9689d653428a42961b544ab7d8cdd4ab9b16b9e0107f6197d35eb930937d768d05de77a
SSDEEP

12288:NIdWET/mr9K+22BEEzFatnQlfv+57k4YpXLJm6EpC8dRi/74RpdltBTUQGp1/2/8:eWtb3BEsfvYQ4kJmBU/7erltfCe/cvq+

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tpkipl.com
Port:
587
Username:
[email protected]
Password:
Admin@8888
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
2588	MSBuild.exe
2588	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
Token: SeDebugPrivilege	2588	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28
PID 1712 wrote to memory of 2588	1712	b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe	28

C:\Users\Admin\AppData\Local\Temp\b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe
"C:\Users\Admin\AppData\Local\Temp\b63313fd857ab782a4208924a5d304ea0939489f297aaf030f2457856fca288f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x000000007498E000-0x000000007498F000-memory.dmp

Filesize
4KB

Download
memory/1712-1-0x00000000012E0000-0x00000000013A4000-memory.dmp

Filesize
784KB

Download
memory/1712-2-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/1712-3-0x0000000000720000-0x0000000000742000-memory.dmp

Filesize
136KB

Download
memory/1712-4-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/1712-5-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1712-6-0x0000000005F80000-0x0000000006002000-memory.dmp

Filesize
520KB

Download
memory/1712-7-0x000000007498E000-0x000000007498F000-memory.dmp

Filesize
4KB

Download
memory/1712-8-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/1712-24-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-17-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2588-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2588-20-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2588-18-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2588-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2588-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2588-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2588-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2588-23-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-25-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download
memory/2588-26-0x0000000074980000-0x000000007506E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing