agenttesla | 8e8e7ded0eaedda43532fa04b96252d50fe3a6d668a21a4aff051abbb74ac085

Analysis

max time kernel
97s
max time network
47s
platform
windows7_x64
resource
win7v20201028
submitted
06/01/2021, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$17800.exe
Size 959KB
Sample210106-4passxth72
SHA256 8e8e7ded0eaedda43532fa04b96252d50fe3a6d668a21a4aff051abbb74ac085
MD5 52414d9d7d48524e4b07965dfaa34566
SHA1 db708f0f848895cbeb08f3a5f88b8cc6aaf6fe47
SHA512 b1c65dd7cdf3920145d6b9b04194d926722f1230140d6f88f6c7cf5bbb79c25857d89eecce3e81623b9044ec24164bff79a1a57515b3a0be4018683a9c83f98a
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.famasoluciones.com
Port
587
Username
[email protected]
Password
v9Ddyv](%?Nn

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1932-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1932-8-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1932-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1932-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1424 set thread context of 1932	1424	$17800.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1932	$17800.exe
1932	$17800.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	$17800.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29
PID 1424 wrote to memory of 1932	1424	$17800.exe	29

C:\Users\Admin\AppData\Local\Temp\$17800.exe
"C:\Users\Admin\AppData\Local\Temp\$17800.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Users\Admin\AppData\Local\Temp\$17800.exe
  "C:\Users\Admin\AppData\Local\Temp\$17800.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-2-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download

memory/1424-3-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/1424-5-0x00000000003B0000-0x00000000003C7000-memory.dmp

Download

memory/1424-6-0x0000000005330000-0x000000000539B000-memory.dmp

Download

memory/1932-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1932-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1932-10-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1932-11-0x0000000074520000-0x0000000074C0E000-memory.dmp

Download