agenttesla | e0b95a4255056cbad985d2d8e2ef1ab22720b758af99bd8d15a5d2d81d650fff

Analysis

max time kernel
127s
max time network
132s
platform
windows10_x64
resource
win10
submitted
12/08/2020, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QUOTE B1307.pdf.exe
Size 599KB
Sample200812-878kehtesx
SHA256 e0b95a4255056cbad985d2d8e2ef1ab22720b758af99bd8d15a5d2d81d650fff
MD5 c8a3944d68f87728d166653b71d44de5
SHA1 528d3912a8cb1322b7afc32948139813fd7b74db
SHA512 e24500bc93fcf500af14420e43bf82c1243c4cd8247bfa0ab962110cef3697eb5f6e4a6f42b3227f6eb027c7cd10a99eae69deff3d6a325c53bad331b8d00678
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
sOeKk#E6

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3788-10-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/3788-11-0x0000000000446C2E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 384 set thread context of 3788	384	QUOTE B1307.pdf.exe	67

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
384	QUOTE B1307.pdf.exe
384	QUOTE B1307.pdf.exe
384	QUOTE B1307.pdf.exe
3788	RegSvcs.exe
3788	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	QUOTE B1307.pdf.exe
Token: SeDebugPrivilege	3788	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67
PID 384 wrote to memory of 3788	384	QUOTE B1307.pdf.exe	67

C:\Users\Admin\AppData\Local\Temp\QUOTE B1307.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTE B1307.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-0-0x0000000073980000-0x000000007406E000-memory.dmp

Download

memory/384-1-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/384-3-0x00000000058D0000-0x00000000058D1000-memory.dmp

Download

memory/384-4-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/384-5-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/384-6-0x0000000008840000-0x0000000008841000-memory.dmp

Download

memory/384-7-0x0000000005500000-0x0000000005504000-memory.dmp

Download

memory/384-8-0x0000000008D20000-0x0000000008D8A000-memory.dmp

Download

memory/384-9-0x0000000004DA0000-0x0000000004DF2000-memory.dmp

Download

memory/3788-10-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3788-12-0x0000000073980000-0x000000007406E000-memory.dmp

Download

memory/3788-17-0x0000000005760000-0x0000000005761000-memory.dmp

Download

memory/3788-18-0x0000000005F40000-0x0000000005F41000-memory.dmp

Download