agenttesla | 0565a0ae6dc721022cfcc38217470d5482e019e530631a249b59052d54db25bb

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7v20201028
submitted
19/11/2020, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zahlung.exe
Size 604KB
Sample201119-ctxbdebwxa
SHA256 0565a0ae6dc721022cfcc38217470d5482e019e530631a249b59052d54db25bb
MD5 c0c87b17394fa26a71226ad6e91990e6
SHA1 53afca4078c7cd71a4bd7e5ffaab5d54d5470670
SHA512 43dc597a0f7750185eada79d2f76b300f9ceac7a6180d301e505a57b8168334f6281c03c61d344e0ba11fee9d99a55e4dc4afba5243f67ca1d182786261be198
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.greatdeck.co
Port
587
Username
[email protected]
Password
Greatd@2018$!

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1648-5-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1648-6-0x000000000043762E-mapping.dmp	family_agenttesla
behavioral1/memory/1648-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1648-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 1648	1960	Zahlung.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1648	RegAsm.exe
1648	RegAsm.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1960	Zahlung.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1648	RegAsm.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29
PID 1960 wrote to memory of 1648	1960	Zahlung.exe	29

C:\Users\Admin\AppData\Local\Temp\Zahlung.exe
"C:\Users\Admin\AppData\Local\Temp\Zahlung.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-5-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1648-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1648-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1648-9-0x0000000074120000-0x000000007480E000-memory.dmp

Download

memory/1960-0-0x0000000074200000-0x00000000748EE000-memory.dmp

Download

memory/1960-1-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/1960-3-0x0000000002120000-0x000000000215E000-memory.dmp

Download