agenttesla | d622d02dfd5ebd085c835d848b2a25091c06751f150575b9092bb99e98f94e31

General

Target
PI20080111-Signed.exe
Size 781KB
Sample201017-7f2vxcyhm6
SHA256 d622d02dfd5ebd085c835d848b2a25091c06751f150575b9092bb99e98f94e31
MD5 5537199bf32bb0360c00a23e1c3e1567
SHA1 ff21bc772ded81fd616bde4ae99dc79bb37b91c0
SHA512 3b0a8d1eaca72588f321d9b938849c0173a200a099a11ac0bb6575d6cdd3c08b2e242b2db54168a14d3b3613a5c2ad5cdaefc4eba8269ccccd4e33d082f93e39
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.ceeit.co.za
Port
587
Username
[email protected]
Password
123diy123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1816-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1816-8-0x000000000043787E-mapping.dmp	family_agenttesla
behavioral1/memory/1816-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1816-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1000 set thread context of 1816	1000	PI20080111-Signed.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	RegAsm.exe
1816	RegAsm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1000	PI20080111-Signed.exe
1000	PI20080111-Signed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1816	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1816	RegAsm.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1168	1000	PI20080111-Signed.exe	25
PID 1000 wrote to memory of 1168	1000	PI20080111-Signed.exe	25
PID 1000 wrote to memory of 1168	1000	PI20080111-Signed.exe	25
PID 1000 wrote to memory of 1168	1000	PI20080111-Signed.exe	25
PID 1000 wrote to memory of 1168	1000	PI20080111-Signed.exe	25
PID 1000 wrote to memory of 1168	1000	PI20080111-Signed.exe	25
PID 1000 wrote to memory of 1168	1000	PI20080111-Signed.exe	25
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27
PID 1000 wrote to memory of 1816	1000	PI20080111-Signed.exe	27

C:\Users\Admin\AppData\Local\Temp\PI20080111-Signed.exe
"C:\Users\Admin\AppData\Local\Temp\PI20080111-Signed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-0-0x0000000074360000-0x0000000074A4E000-memory.dmp

Download

memory/1000-1-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1000-3-0x00000000020A0000-0x00000000020DE000-memory.dmp

Download

memory/1000-5-0x00000000003B0000-0x00000000003EC000-memory.dmp

Download

memory/1816-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1816-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1816-10-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1816-11-0x00000000736A0000-0x0000000073D8E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads