agenttesla | 9280d69cf9742c45fd029bba3fe70b154ecad92a31c5ccf30259e5802bb330a9

Analysis

max time kernel
146s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
13/03/2021, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06201d2da6ff320d841584ea956d32d0.exe
Size 672KB
Sample210313-vx59wypd32
SHA256 9280d69cf9742c45fd029bba3fe70b154ecad92a31c5ccf30259e5802bb330a9
MD5 06201d2da6ff320d841584ea956d32d0
SHA1 9d1fd4a7b7baa6693cf3cecb54b7c7c7672b5a34
SHA512 2315110c0f348023fd9939afe972835bec360807560a811b6194e26bebfc78dcbb00a25c96c52722653479d694c0e0ad508c58fa544a2fc52ff4974171c80d53
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
W(%RQ@J7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/636-14-0x00000000004375FE-mapping.dmp	family_agenttesla
behavioral2/memory/636-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
636	06201d2da6ff320d841584ea956d32d0.exe
636	06201d2da6ff320d841584ea956d32d0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	06201d2da6ff320d841584ea956d32d0.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78
PID 4776 wrote to memory of 636	4776	06201d2da6ff320d841584ea956d32d0.exe	78

C:\Users\Admin\AppData\Local\Temp\06201d2da6ff320d841584ea956d32d0.exe
"C:\Users\Admin\AppData\Local\Temp\06201d2da6ff320d841584ea956d32d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\06201d2da6ff320d841584ea956d32d0.exe
  "C:\Users\Admin\AppData\Local\Temp\06201d2da6ff320d841584ea956d32d0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-23-0x0000000005B70000-0x0000000005B71000-memory.dmp

Download

memory/636-22-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/636-21-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/636-16-0x0000000073360000-0x0000000073A4E000-memory.dmp

Download

memory/636-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4776-7-0x00000000051E0000-0x00000000051E1000-memory.dmp

Download

memory/4776-11-0x0000000005110000-0x0000000005111000-memory.dmp

Download

memory/4776-12-0x0000000008230000-0x00000000082A7000-memory.dmp

Download

memory/4776-10-0x0000000005120000-0x000000000512C000-memory.dmp

Download

memory/4776-9-0x00000000053A0000-0x00000000053A1000-memory.dmp

Download

memory/4776-8-0x00000000050F0000-0x00000000050F1000-memory.dmp

Download

memory/4776-2-0x0000000073360000-0x0000000073A4E000-memory.dmp

Download

memory/4776-6-0x00000000056E0000-0x00000000056E1000-memory.dmp

Download

memory/4776-5-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/4776-3-0x0000000000820000-0x0000000000821000-memory.dmp

Download