agenttesla | 841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb

General

Target
841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe
Size 722KB
Sample201110-cr2nhtd1m2
SHA256 841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb
MD5 b214138348543213d0247d3c1abfe5a3
SHA1 f927b7724e2cbdf35a367b38bea57d77082b57d0
SHA512 fb0fda898a3e960f5dee789f38ae429a27c7af83492aee6e7290ca6d9bee3daab1ff85704bdc5bca46a4a3d18dc13653b4324a84bf24368a1fc5e135c17df5c3
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan upx

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.hybridgroupco.com
Port
587
Username
[email protected]
Password
Obinna123@@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2032-4-0x0000000000400000-0x0000000000486000-memory.dmp	family_agenttesla
behavioral1/memory/2032-2-0x0000000000483F70-mapping.dmp	family_agenttesla
behavioral1/memory/2032-5-0x0000000000360000-0x000000000039C000-memory.dmp	family_agenttesla
behavioral1/memory/2032-7-0x00000000002A0000-0x00000000002D6000-memory.dmp	family_agenttesla

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2032-1-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2032-4-0x0000000000400000-0x0000000000486000-memory.dmp	upx
behavioral1/memory/2032-3-0x0000000000400000-0x0000000000486000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 2032	1096	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	25

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1096	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe
2032	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe
2032	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1096	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2032	1096	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	25
PID 1096 wrote to memory of 2032	1096	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	25
PID 1096 wrote to memory of 2032	1096	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	25
PID 1096 wrote to memory of 2032	1096	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	25
PID 2032 wrote to memory of 1644	2032	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	30
PID 2032 wrote to memory of 1644	2032	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	30
PID 2032 wrote to memory of 1644	2032	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	30
PID 2032 wrote to memory of 1644	2032	841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe	30

C:\Users\Admin\AppData\Local\Temp\841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe
"C:\Users\Admin\AppData\Local\Temp\841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe
  "C:\Users\Admin\AppData\Local\Temp\841b06b50c50fb14aa583956475f860d25ce4180d9cd7d26090cc96cea3903eb.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 564
    3⤵
    PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-0-0x0000000000400000-0x00000000004BB000-memory.dmp

Download

memory/1644-10-0x0000000001FA0000-0x0000000001FB1000-memory.dmp

Download

memory/2032-1-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2032-4-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2032-3-0x0000000000400000-0x0000000000486000-memory.dmp

Download

memory/2032-5-0x0000000000360000-0x000000000039C000-memory.dmp

Download

memory/2032-6-0x0000000000352000-0x0000000000353000-memory.dmp

Download

memory/2032-7-0x00000000002A0000-0x00000000002D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads