agenttesla | aff3a5fa9bbbeaa48631511bfcf0a0cd9b4873cb2087acdc6e7a05fe3bfaaa2a

General

Target
Repeat Order 2020.PDF File.exe
Size 613KB
Sample200701-9daqfyxkzx
SHA256 aff3a5fa9bbbeaa48631511bfcf0a0cd9b4873cb2087acdc6e7a05fe3bfaaa2a
MD5 059c5260e942f077b7a123580cc6815c
SHA1 0efc6d930532b3e6c9fe18f8ea05dfc73c3426e2
SHA512 e7c786facf98a557d191fc154af026757a38d927ef2e632a98eff009b80e375f50239db45537894d5eadde9f79cda55b1f2ef03af0eca3d77a76968d7a522d33
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
ekeneobi12345

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3804-2-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/3804-3-0x000000000044790E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4064 set thread context of 3864	4064	Repeat Order 2020.PDF File.exe	68
PID 3864 set thread context of 3804	3864	RegAsm.exe	69

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3804	RegAsm.exe
3804	RegAsm.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4064	Repeat Order 2020.PDF File.exe
4064	Repeat Order 2020.PDF File.exe
3864	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3804	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3804	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3852	4064	Repeat Order 2020.PDF File.exe	67
PID 4064 wrote to memory of 3852	4064	Repeat Order 2020.PDF File.exe	67
PID 4064 wrote to memory of 3852	4064	Repeat Order 2020.PDF File.exe	67
PID 4064 wrote to memory of 3864	4064	Repeat Order 2020.PDF File.exe	68
PID 4064 wrote to memory of 3864	4064	Repeat Order 2020.PDF File.exe	68
PID 4064 wrote to memory of 3864	4064	Repeat Order 2020.PDF File.exe	68
PID 4064 wrote to memory of 3864	4064	Repeat Order 2020.PDF File.exe	68
PID 3864 wrote to memory of 3804	3864	RegAsm.exe	69
PID 3864 wrote to memory of 3804	3864	RegAsm.exe	69
PID 3864 wrote to memory of 3804	3864	RegAsm.exe	69
PID 3864 wrote to memory of 3804	3864	RegAsm.exe	69

C:\Users\Admin\AppData\Local\Temp\Repeat Order 2020.PDF File.exe
"C:\Users\Admin\AppData\Local\Temp\Repeat Order 2020.PDF File.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3804-2-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3864-0-0x0000000000400000-0x0000000000486000-memory.dmp