agenttesla | 29ea2eab384e58eb174a1a628b6f66b96bf7c40b5f8213169dcdd8b9703def18

Analysis

max time kernel
124s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
05/03/2021, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4eb249b8415632ce0f140e470425f031.exe
Size 1.2MB
Sample210305-ph3e6d6qe6
SHA256 29ea2eab384e58eb174a1a628b6f66b96bf7c40b5f8213169dcdd8b9703def18
MD5 4eb249b8415632ce0f140e470425f031
SHA1 ed6b940cad02498e2d09978b3aec228772774886
SHA512 cdfb46e76345ac8147a76f5b33a44c24143eddf59b4a7823c631a666a964917c0dd4d5ccf223d6768fcfa5c1da8bf5a93ec224b69fda6d20355be621dc2589ec
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
lord@blessme

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1996-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1996-13-0x000000000043765E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	4eb249b8415632ce0f140e470425f031.exe
1996	4eb249b8415632ce0f140e470425f031.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	4eb249b8415632ce0f140e470425f031.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78
PID 648 wrote to memory of 1996	648	4eb249b8415632ce0f140e470425f031.exe	78

C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe
"C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe
  "C:\Users\Admin\AppData\Local\Temp\4eb249b8415632ce0f140e470425f031.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-11-0x0000000005110000-0x000000000516D000-memory.dmp

Download

memory/648-3-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/648-6-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/648-7-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/648-8-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/648-9-0x0000000004F20000-0x0000000004F21000-memory.dmp

Download

memory/648-5-0x00000000053F0000-0x00000000053F1000-memory.dmp

Download

memory/648-2-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/648-10-0x0000000004F10000-0x0000000004F17000-memory.dmp

Download

memory/1996-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1996-15-0x0000000073E00000-0x00000000744EE000-memory.dmp

Download

memory/1996-20-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/1996-21-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/1996-22-0x0000000005C80000-0x0000000005C81000-memory.dmp

Download