agenttesla | f5c20b9e96fde1f84b7578a3f29a00f96e161c9bbdfac2675fcd253b41627a9e

General

Target
camscanner 07072020.exe
Size 661KB
Sample200817-pdfnyb77sx
SHA256 f5c20b9e96fde1f84b7578a3f29a00f96e161c9bbdfac2675fcd253b41627a9e
MD5 42ad14940c3940a3024c6186430d8ff5
SHA1 e60cd881d7f66d7aa5dcd60db15bb25232da6038
SHA512 8d1dd4974e69de549f48a1cb151502164d0177d63f644a26c4f11c90a8507ab77a2e5d41b9eb330ce8494b015a5fcbe67fce70ba1786763c9958153378019214
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.rajhibulid.com
Port
587
Username
[email protected]
Password
chuks0147

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 7 IoCs

resource	yara_rule
behavioral2/memory/3792-0-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral2/memory/3792-1-0x00000000004473FE-mapping.dmp	family_agenttesla
behavioral2/memory/3792-7-0x00000000004473FE-mapping.dmp	family_agenttesla
behavioral2/memory/3792-9-0x00000000004473FE-mapping.dmp	family_agenttesla
behavioral2/memory/3792-8-0x00000000004473FE-mapping.dmp	family_agenttesla
behavioral2/memory/3792-10-0x00000000004473FE-mapping.dmp	family_agenttesla
behavioral2/memory/3792-11-0x00000000004473FE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3876 set thread context of 3792	3876	camscanner 07072020.exe	74

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3876	camscanner 07072020.exe
3876	camscanner 07072020.exe
3876	camscanner 07072020.exe
3876	camscanner 07072020.exe
3876	camscanner 07072020.exe
3876	camscanner 07072020.exe
3876	camscanner 07072020.exe
4016	dw20.exe
4016	dw20.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	camscanner 07072020.exe
Token: SeRestorePrivilege	4016	dw20.exe
Token: SeBackupPrivilege	4016	dw20.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 3572	3876	camscanner 07072020.exe	72
PID 3876 wrote to memory of 3572	3876	camscanner 07072020.exe	72
PID 3876 wrote to memory of 3572	3876	camscanner 07072020.exe	72
PID 3876 wrote to memory of 3828	3876	camscanner 07072020.exe	73
PID 3876 wrote to memory of 3828	3876	camscanner 07072020.exe	73
PID 3876 wrote to memory of 3828	3876	camscanner 07072020.exe	73
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3876 wrote to memory of 3792	3876	camscanner 07072020.exe	74
PID 3792 wrote to memory of 4016	3792	RegSvcs.exe	75
PID 3792 wrote to memory of 4016	3792	RegSvcs.exe	75
PID 3792 wrote to memory of 4016	3792	RegSvcs.exe	75

C:\Users\Admin\AppData\Local\Temp\camscanner 07072020.exe
"C:\Users\Admin\AppData\Local\Temp\camscanner 07072020.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:3572
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:3828
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 712
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3792-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4016-3-0x0000000002840000-0x0000000002841000-memory.dmp

Download

memory/4016-4-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Download

memory/4016-5-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Download

memory/4016-13-0x0000000002F90000-0x0000000002F91000-memory.dmp

Download

memory/4016-30-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads