agenttesla | 48d549e9bbe11f4e45cd39a99f3668743076c63361d1e7fd7dedcd361b4cf368

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7v20201028
submitted
06/11/2020, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
po478.exe
Size 1.6MB
Sample201106-m1a9daq35x
SHA256 48d549e9bbe11f4e45cd39a99f3668743076c63361d1e7fd7dedcd361b4cf368
MD5 69f9178b3240d69ce8676a19c2c6955e
SHA1 1f9f67b732b97342ac9c373513a7da156f78bc05
SHA512 d7cab2a6527b4f5c5ce946a62f4122a945d607e9dd3c50a07e0ba2f78ccc8aff543c67f06032243486ee90b313e67895211c00e199a6d69dd9dfec8022396071
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.blenco.eu
Port
587
Username
[email protected]
Password
rDF#Qwk2

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1620-36-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/1620-37-0x00000000004617FE-mapping.dmp	family_agenttesla
behavioral1/memory/1620-38-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral1/memory/1620-39-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 964	1848	po478.exe	30
PID 964 set thread context of 1620	964	InstallUtil.exe	31

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1848	po478.exe
964	InstallUtil.exe
1620	InstallUtil.exe
1620	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	po478.exe
Token: SeDebugPrivilege	964	InstallUtil.exe
Token: SeDebugPrivilege	1620	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 1848 wrote to memory of 964	1848	po478.exe	30
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31
PID 964 wrote to memory of 1620	964	InstallUtil.exe	31

C:\Users\Admin\AppData\Local\Temp\po478.exe
"C:\Users\Admin\AppData\Local\Temp\po478.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/964-25-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/964-29-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/964-28-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/964-27-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/1620-36-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/1620-38-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/1620-39-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/1620-40-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download

memory/1848-24-0x0000000000680000-0x000000000068A000-memory.dmp

Download

memory/1848-5-0x00000000003F0000-0x00000000003F6000-memory.dmp

Download

memory/1848-4-0x00000000003B0000-0x00000000003CF000-memory.dmp

Download

memory/1848-3-0x0000000000380000-0x0000000000397000-memory.dmp

Download

memory/1848-1-0x00000000010B0000-0x00000000010B1000-memory.dmp

Download

memory/1848-0-0x00000000742C0000-0x00000000749AE000-memory.dmp

Download