agenttesla | 29ea2eab384e58eb174a1a628b6f66b96bf7c40b5f8213169dcdd8b9703def18

Analysis

max time kernel
122s
max time network
17s
platform
windows7_x64
resource
win7v20201028
submitted
05/03/2021, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4eb249b8415632ce0f140e470425f031.exe
Size 1.2MB
Sample210305-ph3e6d6qe6
SHA256 29ea2eab384e58eb174a1a628b6f66b96bf7c40b5f8213169dcdd8b9703def18
MD5 4eb249b8415632ce0f140e470425f031
SHA1 ed6b940cad02498e2d09978b3aec228772774886
SHA512 cdfb46e76345ac8147a76f5b33a44c24143eddf59b4a7823c631a666a964917c0dd4d5ccf223d6768fcfa5c1da8bf5a93ec224b69fda6d20355be621dc2589ec
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
lord@blessme

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/380-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/380-9-0x000000000043765E-mapping.dmp	family_agenttesla
behavioral1/memory/380-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1056 set thread context of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
380	4eb249b8415632ce0f140e470425f031.exe
380	4eb249b8415632ce0f140e470425f031.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	4eb249b8415632ce0f140e470425f031.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29
PID 1056 wrote to memory of 380	1056	4eb249b8415632ce0f140e470425f031.exe	29

C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe
"C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe
  "C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/380-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/380-10-0x0000000073C60000-0x000000007434E000-memory.dmp

Download

memory/380-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/380-13-0x0000000004A20000-0x0000000004A21000-memory.dmp

Download

memory/1056-2-0x0000000073C60000-0x000000007434E000-memory.dmp

Download

memory/1056-3-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1056-5-0x0000000004D40000-0x0000000004D41000-memory.dmp

Download

memory/1056-6-0x0000000000720000-0x0000000000727000-memory.dmp

Download

memory/1056-7-0x00000000042B0000-0x000000000430D000-memory.dmp

Download