agenttesla | 693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762

General

Target
693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe
Size 623KB
Sample201114-8nzdsvx366
SHA256 693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762
MD5 c5be5e8ff978dee30f7308fb873cceca
SHA1 1350e3fd471dee343862c1846f1b47db88d15ccb
SHA512 b93dc6fc97b406458831321a3f1882da04d47bfa66804256dbc348e3d3d4a504fa6b643f68213770652fed533550b91fc90d3cb18150622158ee86fe5be231be
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.ebop.website
Port
587
Username
[email protected]
Password
P@ssw0rdP@ssw0rd

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1232-7-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/1232-6-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1232-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1232-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	RegAsm.exe
1232	RegAsm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe
1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1232	RegAsm.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1784	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	29
PID 1640 wrote to memory of 1784	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	29
PID 1640 wrote to memory of 1784	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	29
PID 1640 wrote to memory of 1784	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	29
PID 1640 wrote to memory of 1784	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	29
PID 1640 wrote to memory of 1784	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	29
PID 1640 wrote to memory of 1784	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	29
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30
PID 1640 wrote to memory of 1232	1640	693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe	30

C:\Users\Admin\AppData\Local\Temp\693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe
"C:\Users\Admin\AppData\Local\Temp\693e675d00cbdc446dd08caa1a50d6fea6bef5c44e2e4ba0d45160f25daa0762.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-6-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1232-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1232-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1232-10-0x0000000073850000-0x0000000073F3E000-memory.dmp

Download

memory/1640-0-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Download

memory/1640-1-0x0000000000940000-0x0000000000941000-memory.dmp

Download

memory/1640-3-0x0000000002250000-0x000000000228E000-memory.dmp

Download

memory/1640-5-0x00000000004F0000-0x000000000052C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads