agenttesla | 4bbf9ed702b29b21bf873a4c492534217b3a3e1db434293973665a6981c646ac

Analysis

max time kernel
145s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
26-02-2021 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PROFORMA INVOICE.exe

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hybridgroupco.com
Port:
587
Username:
[email protected]
Password:
Obinna123@@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/768-9-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral1/memory/768-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/768-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

PROFORMA INVOICE.exe

description pid process target process

PID 1908 set thread context of 768 1908 PROFORMA INVOICE.exe PROFORMA INVOICE.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PROFORMA INVOICE.exe

pid process

768 PROFORMA INVOICE.exe
768 PROFORMA INVOICE.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PROFORMA INVOICE.exe

description pid process

Token: SeDebugPrivilege 768 PROFORMA INVOICE.exe

description	pid	process	target process
PID 1908 set thread context of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe

pid	process
768	PROFORMA INVOICE.exe
768	PROFORMA INVOICE.exe

description	pid	process
Token: SeDebugPrivilege	768	PROFORMA INVOICE.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

PROFORMA INVOICE.exe

description	pid	process	target process
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe
PID 1908 wrote to memory of 768	1908	PROFORMA INVOICE.exe	PROFORMA INVOICE.exe

C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe
"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/768-9-0x00000000004375EE-mapping.dmp

Download
memory/768-8-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-10-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/768-11-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/768-13-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/1908-2-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/1908-3-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/1908-5-0x00000000003D0000-0x00000000003D3000-memory.dmp

Filesize
12KB

Download
memory/1908-6-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/1908-7-0x0000000004490000-0x00000000044EC000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads