agenttesla | fee4980a1f01ebd4ba05ec27d0d03f7083e2b3cbc959e34d5f238865637f9e7e

Analysis

max time kernel
106s
max time network
29s
platform
windows7_x64
resource
win7v200722
submitted
20/10/2020, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INQUIRY.exe
Size 494KB
Sample201020-6kfbbbed2e
SHA256 fee4980a1f01ebd4ba05ec27d0d03f7083e2b3cbc959e34d5f238865637f9e7e
MD5 7c3bb89998541e008127b65872b9165f
SHA1 f1ad5132ce90ae94a2a3586bf801130b3b72ae28
SHA512 cc11c1a73d0f3b25a9c109d092d6d50498a3a129e47761911f3aa435224e46b434d2366135892150371b99ff638de1b8777e1e6645aa049007e9abc05056b783
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.macdernnid.com
Port
587
Username
[email protected]
Password
kaka1234@1

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1944-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1944-6-0x000000000043767E-mapping.dmp	family_agenttesla
behavioral1/memory/1944-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1944-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 1944	1480	INQUIRY.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	INQUIRY.exe
1944	INQUIRY.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	INQUIRY.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28
PID 1480 wrote to memory of 1944	1480	INQUIRY.exe	28

C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe
"C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\INQUIRY.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-0-0x0000000074430000-0x0000000074B1E000-memory.dmp

Download

memory/1480-1-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/1480-3-0x00000000003C0000-0x00000000003D6000-memory.dmp

Download

memory/1480-4-0x0000000005400000-0x0000000005464000-memory.dmp

Download

memory/1944-5-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1944-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1944-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1944-9-0x0000000074430000-0x0000000074B1E000-memory.dmp

Download