agenttesla | 48d549e9bbe11f4e45cd39a99f3668743076c63361d1e7fd7dedcd361b4cf368

Analysis

max time kernel
60s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
06/11/2020, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
po478.exe
Size 1.6MB
Sample201106-m1a9daq35x
SHA256 48d549e9bbe11f4e45cd39a99f3668743076c63361d1e7fd7dedcd361b4cf368
MD5 69f9178b3240d69ce8676a19c2c6955e
SHA1 1f9f67b732b97342ac9c373513a7da156f78bc05
SHA512 d7cab2a6527b4f5c5ce946a62f4122a945d607e9dd3c50a07e0ba2f78ccc8aff543c67f06032243486ee90b313e67895211c00e199a6d69dd9dfec8022396071
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.blenco.eu
Port
587
Username
[email protected]
Password
rDF#Qwk2

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/912-28-0x0000000000400000-0x0000000000466000-memory.dmp	family_agenttesla
behavioral2/memory/912-29-0x00000000004617FE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 580 set thread context of 2532	580	po478.exe	78
PID 2532 set thread context of 912	2532	InstallUtil.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
580	po478.exe
2532	InstallUtil.exe
912	InstallUtil.exe
912	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	580	po478.exe
Token: SeDebugPrivilege	2532	InstallUtil.exe
Token: SeDebugPrivilege	912	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 580 wrote to memory of 2532	580	po478.exe	78
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79
PID 2532 wrote to memory of 912	2532	InstallUtil.exe	79

C:\Users\Admin\AppData\Local\Temp\po478.exe
"C:\Users\Admin\AppData\Local\Temp\po478.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-11-0x0000000009AA0000-0x0000000009AAA000-memory.dmp

Download

memory/580-3-0x0000000001560000-0x0000000001577000-memory.dmp

Download

memory/580-4-0x0000000005980000-0x0000000005981000-memory.dmp

Download

memory/580-5-0x0000000005950000-0x000000000596F000-memory.dmp

Download

memory/580-6-0x0000000008530000-0x0000000008531000-memory.dmp

Download

memory/580-7-0x0000000008120000-0x0000000008121000-memory.dmp

Download

memory/580-8-0x0000000001880000-0x0000000001886000-memory.dmp

Download

memory/580-9-0x00000000081C0000-0x00000000081C1000-memory.dmp

Download

memory/580-0-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/580-10-0x0000000009970000-0x0000000009971000-memory.dmp

Download

memory/580-1-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/580-12-0x0000000009AE0000-0x0000000009AE1000-memory.dmp

Download

memory/912-28-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/912-31-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/912-36-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/912-39-0x00000000065C0000-0x00000000065C1000-memory.dmp

Download

memory/2532-13-0x0000000000400000-0x00000000004DE000-memory.dmp

Download

memory/2532-15-0x0000000073F80000-0x000000007466E000-memory.dmp

Download