agenttesla | 3728b436ce177b5153e4b5a673d79f2dbf2e377960e35fea9db40bae8ec04618

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7v20201028
submitted
25/01/2021, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 985KB
Sample210125-bs8eaprh3a
SHA256 3728b436ce177b5153e4b5a673d79f2dbf2e377960e35fea9db40bae8ec04618
MD5 27b3c8dd22bfff02350e742b4cf1a8b0
SHA1 69c60c67e7b987f75fbf22f21378e62e679d60c1
SHA512 bcc9e051de2d20477e181254c287ac1a85125e1a90420b71171bf4085a9ef452a76924eee53f3dc731a259977f1252b7b09e78d5431e1fbfba512f5e84b05ed0
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
barclays247.com
Port
587
Username
[email protected]
Password
Du_&#[]2y&k*

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1368-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1368-9-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral1/memory/1368-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 1368	1656	file.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	file.exe
1368	file.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	file.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29
PID 1656 wrote to memory of 1368	1656	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1368-10-0x0000000074640000-0x0000000074D2E000-memory.dmp

Download

memory/1368-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1368-13-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/1656-2-0x0000000074640000-0x0000000074D2E000-memory.dmp

Download

memory/1656-3-0x0000000001210000-0x0000000001211000-memory.dmp

Download

memory/1656-5-0x00000000005B0000-0x00000000005D3000-memory.dmp

Download

memory/1656-6-0x0000000000620000-0x0000000000621000-memory.dmp

Download

memory/1656-7-0x00000000054A0000-0x0000000005516000-memory.dmp

Download