agenttesla | c9b11315a65d68d5577ca5b762e4d5d16f660b1ffde12cd5192c9717747a63ca

Analysis

max time kernel
131s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
16/03/2021, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Enquiry List.exe
Size 1.0MB
Sample210316-5swseq82hs
SHA256 c9b11315a65d68d5577ca5b762e4d5d16f660b1ffde12cd5192c9717747a63ca
MD5 0e3611c937911177a709f5ffc83672de
SHA1 19c37068fb9eaade4091d639b4078b1d21e2aee8
SHA512 2bbe96a5d503a242054238b33836db92ad6a330d4ec9383bd2b5403d7c426c03c1b32232a4a74e17bb5f70ff5ae9ee32a77e2cdbbcbe3c2be8feeda1affa3a94
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.zoho.eu
Port
587
Username
[email protected]
Password
payment2021505060

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1680-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1680-9-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral1/memory/1680-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1656 set thread context of 1680	1656	New Enquiry List.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	New Enquiry List.exe
1680	New Enquiry List.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1680	New Enquiry List.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	New Enquiry List.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29
PID 1656 wrote to memory of 1680	1656	New Enquiry List.exe	29

C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe
"C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe
  "C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-2-0x0000000074640000-0x0000000074D2E000-memory.dmp

Download

memory/1656-3-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/1656-5-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download

memory/1656-6-0x00000000002B0000-0x00000000002BB000-memory.dmp

Download

memory/1656-7-0x0000000005120000-0x0000000005194000-memory.dmp

Download

memory/1680-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1680-10-0x0000000074640000-0x0000000074D2E000-memory.dmp

Download

memory/1680-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1680-13-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download