agenttesla | a3c0fba4670ffe0873aa0ac3d0d337e9ead4257b02ad2e768ae2c363b6a9bc94

Analysis

max time kernel
146s
max time network
12s
platform
windows7_x64
resource
win7v20201028
submitted
18/03/2021, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
god.exe
Size 850KB
Sample210318-e482fbphs2
SHA256 a3c0fba4670ffe0873aa0ac3d0d337e9ead4257b02ad2e768ae2c363b6a9bc94
MD5 f5aba857a2feeb7212967f70a0196d11
SHA1 f4dffd993413b02b21564ddb63183ddb75f00526
SHA512 2c2da37988e0ed59a7a725e123afe2913a5dc02a8eea3ee5c625fa28e373f2a873e6c28a3c96587ee13acbef82094d89b3505b77d29f78293b76c3f0640c624b
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
DANIEL3116

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1892-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1892-9-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral1/memory/1892-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 1892	1904	god.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	god.exe
1892	god.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1892	god.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	god.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29
PID 1904 wrote to memory of 1892	1904	god.exe	29

C:\Users\Admin\AppData\Local\Temp\god.exe
"C:\Users\Admin\AppData\Local\Temp\god.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\god.exe
  "C:\Users\Admin\AppData\Local\Temp\god.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1892-10-0x0000000074320000-0x0000000074A0E000-memory.dmp

Download

memory/1892-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1892-13-0x00000000048F0000-0x00000000048F1000-memory.dmp

Download

memory/1904-2-0x0000000074320000-0x0000000074A0E000-memory.dmp

Download

memory/1904-3-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/1904-5-0x0000000000270000-0x000000000027B000-memory.dmp

Download

memory/1904-6-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/1904-7-0x0000000004ED0000-0x0000000004F65000-memory.dmp

Download