agenttesla | c9b11315a65d68d5577ca5b762e4d5d16f660b1ffde12cd5192c9717747a63ca

Analysis

max time kernel
144s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
16/03/2021, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Enquiry List.exe
Size 1.0MB
Sample210316-5swseq82hs
SHA256 c9b11315a65d68d5577ca5b762e4d5d16f660b1ffde12cd5192c9717747a63ca
MD5 0e3611c937911177a709f5ffc83672de
SHA1 19c37068fb9eaade4091d639b4078b1d21e2aee8
SHA512 2bbe96a5d503a242054238b33836db92ad6a330d4ec9383bd2b5403d7c426c03c1b32232a4a74e17bb5f70ff5ae9ee32a77e2cdbbcbe3c2be8feeda1affa3a94
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.zoho.eu
Port
587
Username
[email protected]
Password
payment2021505060

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2376-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2376-14-0x00000000004375EE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 2376	1032	New Enquiry List.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2376	New Enquiry List.exe
2376	New Enquiry List.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2376	New Enquiry List.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	New Enquiry List.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79
PID 1032 wrote to memory of 2376	1032	New Enquiry List.exe	79

C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe
"C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe
  "C:\Users\Admin\AppData\Local\Temp\New Enquiry List.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-7-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/1032-3-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/1032-6-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/1032-2-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Download

memory/1032-8-0x00000000051E0000-0x00000000051E1000-memory.dmp

Download

memory/1032-9-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/1032-5-0x0000000005250000-0x0000000005251000-memory.dmp

Download

memory/1032-10-0x00000000054F0000-0x00000000054F1000-memory.dmp

Download

memory/1032-12-0x0000000006030000-0x00000000060A4000-memory.dmp

Download

memory/1032-11-0x0000000005210000-0x000000000521B000-memory.dmp

Download

memory/2376-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2376-16-0x0000000073EE0000-0x00000000745CE000-memory.dmp

Download

memory/2376-21-0x00000000055D0000-0x00000000055D1000-memory.dmp

Download

memory/2376-22-0x0000000005620000-0x0000000005621000-memory.dmp

Download

memory/2376-23-0x0000000006190000-0x0000000006191000-memory.dmp

Download