agenttesla | df6a630242b0f0bc7f92f38798fcd3eb80f42978ec3bfe22b506e44ac47ab072

Analysis

max time kernel
100s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
14-01-2021 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.2MB
MD5

d49bc0561ba651cb18f2f2b4a91dfff2
SHA1

58de812c4870da61434631dbda3b806bfb9dfc96
SHA256

df6a630242b0f0bc7f92f38798fcd3eb80f42978ec3bfe22b506e44ac47ab072
SHA512

32274f4ffef7390512138006e22e47994e0775f245260bc8a769382ba0d1bbc712c2c920cb39079ea2a13aacdc995362abbc0cc1091cbeae1f2a9e0f9fee86da

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
barclays247.com
Port:
587
Username:
tombag@barclays247.com
Password:
Du_&#[]2y&k*

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/556-10-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/556-11-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral1/memory/556-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/556-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 808 set thread context of 556 808 file.exe file.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

file.exe

pid process

556 file.exe
556 file.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

file.exe

description pid process

Token: SeDebugPrivilege 556 file.exe

description	pid	process	target process
PID 808 set thread context of 556	808	file.exe	file.exe

pid	process
556	file.exe
556	file.exe

description	pid	process
Token: SeDebugPrivilege	556	file.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

file.exe

description	pid	process	target process
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe
PID 808 wrote to memory of 556	808	file.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-10-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/556-11-0x000000000043764E-mapping.dmp

Download
memory/556-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/556-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/556-14-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/808-2-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/808-3-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/808-5-0x0000000000620000-0x0000000000632000-memory.dmp

Filesize
72KB

Download
memory/808-6-0x0000000005030000-0x00000000050C7000-memory.dmp

Filesize
604KB

Download
memory/808-7-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

Filesize
32KB

Download
memory/808-9-0x0000000004D80000-0x0000000004DF9000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads