agenttesla | 59915adde8ff6809e7c41085595d3d74285283bce1c5aa3c25acfe8300f00b50

Analysis

max time kernel
119s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
28-02-2021 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t7TPWzR6ik7Go42.exe

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.hybridgroupco.com
Port:
587
Username:
quinz2021@hybridgroupco.com
Password:
Obinna123@@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2612-3-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2612-4-0x00000000004374CE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

t7TPWzR6ik7Go42.exe

description pid process target process

PID 496 set thread context of 2612 496 t7TPWzR6ik7Go42.exe t7TPWzR6ik7Go42.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

t7TPWzR6ik7Go42.exe

pid process

2612 t7TPWzR6ik7Go42.exe
2612 t7TPWzR6ik7Go42.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

t7TPWzR6ik7Go42.exe

description pid process

Token: SeDebugPrivilege 2612 t7TPWzR6ik7Go42.exe

description	pid	process	target process
PID 496 set thread context of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe

pid	process
2612	t7TPWzR6ik7Go42.exe
2612	t7TPWzR6ik7Go42.exe

description	pid	process
Token: SeDebugPrivilege	2612	t7TPWzR6ik7Go42.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

t7TPWzR6ik7Go42.exe

description	pid	process	target process
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe
PID 496 wrote to memory of 2612	496	t7TPWzR6ik7Go42.exe	t7TPWzR6ik7Go42.exe

C:\Users\Admin\AppData\Local\Temp\t7TPWzR6ik7Go42.exe
"C:\Users\Admin\AppData\Local\Temp\t7TPWzR6ik7Go42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:496

C:\Users\Admin\AppData\Local\Temp\t7TPWzR6ik7Go42.exe
"C:\Users\Admin\AppData\Local\Temp\t7TPWzR6ik7Go42.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\t7TPWzR6ik7Go42.exe.log
MD5
568e6f2b186c39075772d775e4189f57

SHA1
02f642cfdd1491b1ce69e81925ed336975e2f972

SHA256
d29bbfbb510acd8716133feeade8f914076963ccc38abb4b5a64a8d32bac44e4

SHA512
ef3b7f6d6b355c41ca9abb40d769622ea3f79787d8d2501ad5a135fa5cc78712175190386c8e05ee863a3bc046bc09eee22310555d31e4d57a4652f280283156

Download Submit
memory/496-2-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/496-6-0x0000000002D31000-0x0000000002D32000-memory.dmp

Filesize
4KB

Download
memory/2612-3-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2612-4-0x00000000004374CE-mapping.dmp

Download
memory/2612-7-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2612-8-0x0000000000D21000-0x0000000000D22000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads