agenttesla | 586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d

General

Target
61112d94cef0ba979abbb5a670279b80.exe
Size 580KB
Sample210331-stxr72lrt2
SHA256 586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d
MD5 61112d94cef0ba979abbb5a670279b80
SHA1 a851759d44439fb99f73b31ac63d4f610c8b5ebb
SHA512 2160a20c72fb04fca95883fae30116f0b0ccbf4779607cdffa05b9145d2b6102f143f12b6b10196488d06473c2d0d658635122eacc8afbde703b1390084a7be2
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
Thegodfather12345

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1000-9-0x000000000043763E-mapping.dmp	family_agenttesla
behavioral1/memory/1000-8-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1000-11-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 776 set thread context of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
776	61112d94cef0ba979abbb5a670279b80.exe
1000	61112d94cef0ba979abbb5a670279b80.exe
1000	61112d94cef0ba979abbb5a670279b80.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	776	61112d94cef0ba979abbb5a670279b80.exe
Token: SeDebugPrivilege	1000	61112d94cef0ba979abbb5a670279b80.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 268	776	61112d94cef0ba979abbb5a670279b80.exe	29
PID 776 wrote to memory of 268	776	61112d94cef0ba979abbb5a670279b80.exe	29
PID 776 wrote to memory of 268	776	61112d94cef0ba979abbb5a670279b80.exe	29
PID 776 wrote to memory of 268	776	61112d94cef0ba979abbb5a670279b80.exe	29
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30
PID 776 wrote to memory of 1000	776	61112d94cef0ba979abbb5a670279b80.exe	30

C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe
"C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe
  "C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe
  "C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-2-0x0000000073F20000-0x000000007460E000-memory.dmp

Download

memory/776-3-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/776-5-0x00000000003C0000-0x00000000003C9000-memory.dmp

Download

memory/776-6-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

memory/776-7-0x0000000004E00000-0x0000000004E64000-memory.dmp

Download

memory/1000-8-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1000-10-0x0000000073F20000-0x000000007460E000-memory.dmp

Download

memory/1000-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1000-13-0x0000000004980000-0x0000000004981000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads