agenttesla | 61d4dd89bcb94b321942a0ebc30ad2319411eff15bc24ab4769fd00a20a92188

Analysis

max time kernel
131s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
25/03/2021, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order 03-25-2021.exe
Size 1012KB
Sample210325-ay6e8a434n
SHA256 61d4dd89bcb94b321942a0ebc30ad2319411eff15bc24ab4769fd00a20a92188
MD5 ad4a13421fd3c3bf03db117cf136dbd0
SHA1 859a3fc0bc34d06202137c7a7c353dcf32939aa1
SHA512 1380fa2d4c3b48e90ba2a9846363608e9b670ea71946221bcfc76e637a29acb8b51c8ee7c80f8d1812893d6390555c37f5b252ca52685452319646abe60b9d97
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.skintechpharmgroup.com
Port
587
Username
[email protected]
Password
RUT!ZR^9

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3108-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3108-14-0x000000000043787E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 416 set thread context of 3108	416	Purchase Order 03-25-2021.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3108	Purchase Order 03-25-2021.exe
3108	Purchase Order 03-25-2021.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3108	Purchase Order 03-25-2021.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3108	Purchase Order 03-25-2021.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78
PID 416 wrote to memory of 3108	416	Purchase Order 03-25-2021.exe	78

C:\Users\Admin\AppData\Local\Temp\Purchase Order 03-25-2021.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order 03-25-2021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\Purchase Order 03-25-2021.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order 03-25-2021.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/416-7-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/416-3-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/416-6-0x0000000005790000-0x0000000005791000-memory.dmp

Download

memory/416-2-0x0000000073970000-0x000000007405E000-memory.dmp

Download

memory/416-8-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/416-9-0x0000000005510000-0x0000000005511000-memory.dmp

Download

memory/416-5-0x00000000051F0000-0x00000000051F1000-memory.dmp

Download

memory/416-10-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/416-12-0x0000000006EC0000-0x0000000006F39000-memory.dmp

Download

memory/416-11-0x0000000002BE0000-0x0000000002BEB000-memory.dmp

Download

memory/3108-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3108-16-0x0000000073970000-0x000000007405E000-memory.dmp

Download

memory/3108-21-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download

memory/3108-22-0x0000000002930000-0x0000000002931000-memory.dmp

Download

memory/3108-23-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Download