agenttesla | d3f4d352d63d7565acc222c50c0fccf56a7d90ad1623ae32e3a7f0e3b9ea5dfc

Analysis

max time kernel
100s
max time network
21s
platform
windows7_x64
resource
win7v20201028
submitted
20-02-2021 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
Size

599KB
MD5

00d5e736e281b30f3ac9c5783340a561
SHA1

b7266f3f7443368d208ce4b1902cb9e4feaf6f8b
SHA256

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94
SHA512

05c17c2a42a715ec3576275b2daf6090c0710f62758e1fbf1e83792e8408faa28ea1c8d7158a02aa94df2803e9a27b02b07876a7e53d50ed4f092d00ea0b526f

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral9/memory/1440-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral9/memory/1440-9-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral9/memory/1440-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

description	pid	process	target process
PID 1616 set thread context of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

pid	process
1440	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
1440	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

description pid process

Token: SeDebugPrivilege 1440 1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

description	pid	process
Token: SeDebugPrivilege	1440	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

description	pid	process	target process
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
PID 1616 wrote to memory of 1440	1616	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe	1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe

C:\Users\Admin\AppData\Local\Temp\1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
"C:\Users\Admin\AppData\Local\Temp\1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\1e6d2544e8cd4ed8ea47790e172ac3e834ae0d9d0492f6f56726dfc0021c6d94.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1440-9-0x000000000043764E-mapping.dmp

Download
memory/1440-10-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1440-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1440-13-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/1616-2-0x0000000074640000-0x0000000074D2E000-memory.dmp

Filesize
6.9MB

Download
memory/1616-3-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/1616-5-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/1616-6-0x0000000000B00000-0x0000000000B0B000-memory.dmp

Filesize
44KB

Download
memory/1616-7-0x0000000007DE0000-0x0000000007E68000-memory.dmp

Filesize
544KB

Download