agenttesla | 3529f437801eed53684a28376fa14332cf44a3b8396e8473bccdb92bf2fedb25

Analysis

max time kernel
103s
max time network
13s
platform
windows7_x64
resource
win7v20201028
submitted
04/02/2021, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MT103_001.exe
Size 652KB
Sample210204-138xtqhfvs
SHA256 3529f437801eed53684a28376fa14332cf44a3b8396e8473bccdb92bf2fedb25
MD5 390aee82f4e093a91e52cc354e4910ab
SHA1 1571b4534048566e4fbd5520af9bdca35d61db22
SHA512 c7078b8cb364ca61a396bc9ac191450dba24257e6b764a51c86d64b6c23134195d34938ae89520c3d3522dabfe9b2e903b104c4bdcc42c83847bbdd4d9969f3c
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.vivaldi.net
Port
587
Username
[email protected]
Password
@@Io419090@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1800-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1800-9-0x000000000043746E-mapping.dmp	family_agenttesla
behavioral1/memory/1800-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 1800	1852	MT103_001.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1800	MT103_001.exe
1800	MT103_001.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	MT103_001.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29
PID 1852 wrote to memory of 1800	1852	MT103_001.exe	29

C:\Users\Admin\AppData\Local\Temp\MT103_001.exe
"C:\Users\Admin\AppData\Local\Temp\MT103_001.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\MT103_001.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103_001.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1800-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1800-10-0x0000000074840000-0x0000000074F2E000-memory.dmp

Download

memory/1800-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1800-13-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Download

memory/1852-2-0x0000000074840000-0x0000000074F2E000-memory.dmp

Download

memory/1852-3-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/1852-5-0x00000000004A0000-0x00000000004A4000-memory.dmp

Download

memory/1852-6-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/1852-7-0x0000000005250000-0x00000000052B4000-memory.dmp

Download