agenttesla | 22bb4fb64047a3ccdb9e79080e9b9769733a84fceb7d2ec8e82d3823802e33fb | Triage

Analysis

max time kernel
135s
max time network
28s
platform
windows7_x64
resource
win7v200430
submitted
30-06-2020 09:00

Sharing

Report Analysis Logs

General

Target

Quotation.exe
Size

398KB
MD5

acf625220d32911234345c7c65bf0477
SHA1

dea87c877a0ea827b654fb9c0d4e66d51aea212c
SHA256

22bb4fb64047a3ccdb9e79080e9b9769733a84fceb7d2ec8e82d3823802e33fb
SHA512

60622fa547a08ed113c9579372b91c07758bf2fbc3670317e5a227ddaa4968c6297f4c5cef59b1771d86604b5219e7c61a273fe6db9bda55129278abbdd42c5e

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
telley_min@vectromtech.com
Password:
111aaa

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1492-0-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1492-1-0x000000000044A73E-mapping.dmp	family_agenttesla
behavioral1/memory/1492-2-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla
behavioral1/memory/1492-3-0x0000000000400000-0x0000000000450000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Quotation.exe

description pid process target process

PID 1056 set thread context of 1492 1056 Quotation.exe MSBuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

1492 MSBuild.exe
1492 MSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 1492 MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Quotation.exe

description	pid	process	target process
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe
PID 1056 wrote to memory of 1492	1056	Quotation.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1492-1-0x000000000044A73E-mapping.dmp

Download
memory/1492-2-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1492-3-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download