agenttesla | a2267c6724ab4e4a965938b0ee2c926ffa2df8b81ed582c1424d224f35eec2e0

General

Target
Scan_23748991000.exe
Size 865KB
Sample210106-e8xyalakbe
SHA256 a2267c6724ab4e4a965938b0ee2c926ffa2df8b81ed582c1424d224f35eec2e0
MD5 ff65814322f31577345615a1f470f29f
SHA1 92599bab93f7c4f4ffc56d26d289be98a1bc9080
SHA512 f4a89a93062b6450e49abfdf1109deebeb40cc4fc71a44ff26f9eb1da2c7b46fdff6143439c9682e851ec1ffddbe657802d8580e5aa3f32d656f076e2a85e4e5
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.mail.com
Port
587
Username
[email protected]
Password
@@Io419090@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1344-7-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1344-8-0x000000000043747E-mapping.dmp	family_agenttesla
behavioral1/memory/1344-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1344-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 780 set thread context of 1344	780	Scan_23748991000.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
780	Scan_23748991000.exe
780	Scan_23748991000.exe
1344	Scan_23748991000.exe
1344	Scan_23748991000.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	Scan_23748991000.exe
Token: SeDebugPrivilege	1344	Scan_23748991000.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1420	780	Scan_23748991000.exe	29
PID 780 wrote to memory of 1420	780	Scan_23748991000.exe	29
PID 780 wrote to memory of 1420	780	Scan_23748991000.exe	29
PID 780 wrote to memory of 1420	780	Scan_23748991000.exe	29
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30
PID 780 wrote to memory of 1344	780	Scan_23748991000.exe	30

C:\Users\Admin\AppData\Local\Temp\Scan_23748991000.exe
"C:\Users\Admin\AppData\Local\Temp\Scan_23748991000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\Scan_23748991000.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan_23748991000.exe"
  2⤵
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\Scan_23748991000.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan_23748991000.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-2-0x0000000074DD0000-0x00000000754BE000-memory.dmp

Download

memory/780-3-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/780-5-0x00000000003B0000-0x00000000003C7000-memory.dmp

Download

memory/780-6-0x0000000004970000-0x00000000049DB000-memory.dmp

Download

memory/1344-7-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-10-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-11-0x0000000074DD0000-0x00000000754BE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads