agenttesla | b8d5ab09f5c61b3902912efe4b0ce4fb9de4e6725a026cce18096c890b2a6ee9

Analysis

max time kernel
93s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
13/11/2020, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zahlungskopie.exe
Size 613KB
Sample201113-2behrq26ge
SHA256 b8d5ab09f5c61b3902912efe4b0ce4fb9de4e6725a026cce18096c890b2a6ee9
MD5 8c6034dce1c943a9597d99fd01c0999c
SHA1 3b3ab99357b593d7d2454b3b4a2fb2264825e285
SHA512 3753a3e276c7a8acdd5f83813fe58ab1a4876843e2030493d8e0df885b315cf061e81cee0b19e9398ceb1de913289ac0c4dc53bfa3e6d88e86349d447426563d
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.greatdeck.co
Port
587
Username
[email protected]
Password
Greatd@2018$!

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4408-6-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/4408-7-0x000000000043762E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4772 set thread context of 4408	4772	Zahlungskopie.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4408	RegAsm.exe
4408	RegAsm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4772	Zahlungskopie.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4408	RegAsm.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4408	4772	Zahlungskopie.exe	75
PID 4772 wrote to memory of 4408	4772	Zahlungskopie.exe	75
PID 4772 wrote to memory of 4408	4772	Zahlungskopie.exe	75
PID 4772 wrote to memory of 4408	4772	Zahlungskopie.exe	75

C:\Users\Admin\AppData\Local\Temp\Zahlungskopie.exe
"C:\Users\Admin\AppData\Local\Temp\Zahlungskopie.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4408-6-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4408-8-0x0000000073330000-0x0000000073A1E000-memory.dmp

Download

memory/4408-11-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/4408-12-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/4408-13-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/4408-14-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

Download

memory/4408-16-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/4772-0-0x0000000073360000-0x0000000073A4E000-memory.dmp

Download

memory/4772-1-0x0000000000360000-0x0000000000361000-memory.dmp

Download

memory/4772-3-0x0000000004C50000-0x0000000004C51000-memory.dmp

Download

memory/4772-4-0x0000000004F80000-0x0000000004FBE000-memory.dmp

Download