agenttesla | 2afcf205a46aeede621ddf890002c4eed4e9b5044881d625d1f2daa443bc1328

Analysis

max time kernel
121s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
26/03/2021, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Transfer Copy 15536usd.exe
Size 1.1MB
Sample210326-26cclkys4x
SHA256 2afcf205a46aeede621ddf890002c4eed4e9b5044881d625d1f2daa443bc1328
MD5 cce110f84a1f04ea636a22e33e2df99b
SHA1 73da58ef3a3ec4173e88b71c04cd47a28782449d
SHA512 d057bb3568149cf232e8c1b0e280a27daf2ba75f95d7c705057acbd5208465ad8afbe6faba9e074f99d8658d5aed200212e7344b6e63a977cb901fa9f665d291
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.moqas.com
Port
587
Username
[email protected]
Password
ANbggoR0

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/576-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/576-14-0x00000000004375CE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 576	4696	Transfer Copy 15536usd.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4696	Transfer Copy 15536usd.exe
4696	Transfer Copy 15536usd.exe
576	Transfer Copy 15536usd.exe
576	Transfer Copy 15536usd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	Transfer Copy 15536usd.exe
Token: SeDebugPrivilege	576	Transfer Copy 15536usd.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 508	4696	Transfer Copy 15536usd.exe	78
PID 4696 wrote to memory of 508	4696	Transfer Copy 15536usd.exe	78
PID 4696 wrote to memory of 508	4696	Transfer Copy 15536usd.exe	78
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79
PID 4696 wrote to memory of 576	4696	Transfer Copy 15536usd.exe	79

C:\Users\Admin\AppData\Local\Temp\Transfer Copy 15536usd.exe
"C:\Users\Admin\AppData\Local\Temp\Transfer Copy 15536usd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\Transfer Copy 15536usd.exe
  "C:\Users\Admin\AppData\Local\Temp\Transfer Copy 15536usd.exe"
  2⤵
  PID:508
- C:\Users\Admin\AppData\Local\Temp\Transfer Copy 15536usd.exe
  "C:\Users\Admin\AppData\Local\Temp\Transfer Copy 15536usd.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/576-22-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/576-21-0x0000000006050000-0x0000000006051000-memory.dmp

Download

memory/576-20-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/576-15-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/4696-7-0x0000000007640000-0x0000000007641000-memory.dmp

Download

memory/4696-10-0x00000000076E0000-0x00000000076E1000-memory.dmp

Download

memory/4696-11-0x0000000002AF0000-0x0000000002AFB000-memory.dmp

Download

memory/4696-12-0x0000000007410000-0x0000000007477000-memory.dmp

Download

memory/4696-9-0x0000000007510000-0x0000000007511000-memory.dmp

Download

memory/4696-8-0x0000000005160000-0x0000000005161000-memory.dmp

Download

memory/4696-2-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/4696-6-0x0000000007B40000-0x0000000007B41000-memory.dmp

Download

memory/4696-5-0x00000000075A0000-0x00000000075A1000-memory.dmp

Download

memory/4696-3-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download