agenttesla | 8ab6e7ca68c0c1ab0e39ede908135343fbfbfdeb3b6981f4630e6c74e73d7ca3

Analysis

max time kernel
147s
max time network
10s
platform
windows7_x64
resource
win7v20201028
submitted
10/03/2021, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
49633030e579e68c9f262f98dc62c580.exe
Size 1006KB
Sample210310-ake5qvl6vx
SHA256 8ab6e7ca68c0c1ab0e39ede908135343fbfbfdeb3b6981f4630e6c74e73d7ca3
MD5 49633030e579e68c9f262f98dc62c580
SHA1 0a7dfbd479ccc0a3d53bd42ddbbc8c74a3448111
SHA512 a6fa4a6f898cbd17eb6d5ff96d5b13c7a9c65a7c7f7147ff8e3243d85fcad8056b40a61ee6c65bbbe3db4ab92c7463416d9cd77cfa09bccdfff808457de66693
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
W(%RQ@J7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1488-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1488-9-0x00000000004375FE-mapping.dmp	family_agenttesla
behavioral1/memory/1488-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 776 set thread context of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	49633030e579e68c9f262f98dc62c580.exe
1488	49633030e579e68c9f262f98dc62c580.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	49633030e579e68c9f262f98dc62c580.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29
PID 776 wrote to memory of 1488	776	49633030e579e68c9f262f98dc62c580.exe	29

C:\Users\Admin\AppData\Local\Temp\49633030e579e68c9f262f98dc62c580.exe
"C:\Users\Admin\AppData\Local\Temp\49633030e579e68c9f262f98dc62c580.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\49633030e579e68c9f262f98dc62c580.exe
  "C:\Users\Admin\AppData\Local\Temp\49633030e579e68c9f262f98dc62c580.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-2-0x0000000073D40000-0x000000007442E000-memory.dmp

Download

memory/776-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/776-5-0x0000000000500000-0x0000000000507000-memory.dmp

Download

memory/776-6-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/776-7-0x00000000050E0000-0x0000000005147000-memory.dmp

Download

memory/1488-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1488-10-0x0000000073D40000-0x000000007442E000-memory.dmp

Download

memory/1488-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1488-13-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Download