agenttesla | f5c20b9e96fde1f84b7578a3f29a00f96e161c9bbdfac2675fcd253b41627a9e

General

Target
camscanner 07072020.exe
Size 661KB
Sample200817-pdfnyb77sx
SHA256 f5c20b9e96fde1f84b7578a3f29a00f96e161c9bbdfac2675fcd253b41627a9e
MD5 42ad14940c3940a3024c6186430d8ff5
SHA1 e60cd881d7f66d7aa5dcd60db15bb25232da6038
SHA512 8d1dd4974e69de549f48a1cb151502164d0177d63f644a26c4f11c90a8507ab77a2e5d41b9eb330ce8494b015a5fcbe67fce70ba1786763c9958153378019214
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.rajhibulid.com
Port
587
Username
[email protected]
Password
chuks0147

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1808-3-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1808-4-0x00000000004473FE-mapping.dmp	family_agenttesla
behavioral1/memory/1808-5-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/1808-6-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 1808	1108	camscanner 07072020.exe	26

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1108	camscanner 07072020.exe
1108	camscanner 07072020.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	camscanner 07072020.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1108 wrote to memory of 1808	1108	camscanner 07072020.exe	26
PID 1808 wrote to memory of 1860	1808	RegSvcs.exe	27
PID 1808 wrote to memory of 1860	1808	RegSvcs.exe	27
PID 1808 wrote to memory of 1860	1808	RegSvcs.exe	27
PID 1808 wrote to memory of 1860	1808	RegSvcs.exe	27

C:\Users\Admin\AppData\Local\Temp\camscanner 07072020.exe
"C:\Users\Admin\AppData\Local\Temp\camscanner 07072020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 388
    3⤵
    PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-3-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1808-5-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1808-6-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1860-8-0x0000000001E90000-0x0000000001EA1000-memory.dmp

Download

memory/1860-9-0x0000000002360000-0x0000000002371000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads