agenttesla | 6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e

General

Target
6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe
Size 697KB
Sample201114-cpp7v3yx7a
SHA256 6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e
MD5 73c7021ce4fdeb5a1872d4a2071b23c7
SHA1 e3dbf2561d549ea52be65210ab21685defea175c
SHA512 df8353c95451dc47fe3fe3b12c4bbf05ec67b5118c2a40ede259607e82e8eef873308f7c04b6f119ae5f41b749864d8f8fa217b24eb3be2d63fb2cbfcc384e85
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan upx

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.petroclamp.com
Port
587
Username
[email protected]
Password
hanis246

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1860-4-0x0000000000400000-0x0000000000485000-memory.dmp	family_agenttesla
behavioral1/memory/1860-5-0x0000000000380000-0x00000000003BC000-memory.dmp	family_agenttesla
behavioral1/memory/1860-7-0x0000000000260000-0x0000000000296000-memory.dmp	family_agenttesla

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1860-1-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/1860-3-0x0000000000400000-0x0000000000485000-memory.dmp	upx
behavioral1/memory/1860-4-0x0000000000400000-0x0000000000485000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 300 set thread context of 1860	300	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	26

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
300	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe
1860	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe
1860	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
300	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 1860	300	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	26
PID 300 wrote to memory of 1860	300	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	26
PID 300 wrote to memory of 1860	300	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	26
PID 300 wrote to memory of 1860	300	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	26
PID 1860 wrote to memory of 1140	1860	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	30
PID 1860 wrote to memory of 1140	1860	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	30
PID 1860 wrote to memory of 1140	1860	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	30
PID 1860 wrote to memory of 1140	1860	6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe	30

C:\Users\Admin\AppData\Local\Temp\6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe
"C:\Users\Admin\AppData\Local\Temp\6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:300
- C:\Users\Admin\AppData\Local\Temp\6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe
  "C:\Users\Admin\AppData\Local\Temp\6a89a183f77ce7ba8da25bef8fa5f585ec5f96f4fca5fe360511bd7d160ce91e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 564
    3⤵
    PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/300-0-0x0000000000400000-0x00000000004B4000-memory.dmp

Download

memory/1140-10-0x0000000001F20000-0x0000000001F31000-memory.dmp

Download

memory/1860-1-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/1860-3-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/1860-4-0x0000000000400000-0x0000000000485000-memory.dmp

Download

memory/1860-5-0x0000000000380000-0x00000000003BC000-memory.dmp

Download

memory/1860-6-0x0000000001F52000-0x0000000001F53000-memory.dmp

Download

memory/1860-7-0x0000000000260000-0x0000000000296000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads