agenttesla | 586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d

Analysis

max time kernel
145s
max time network
121s
platform
windows10_x64
resource
win10v20201028
submitted
31/03/2021, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61112d94cef0ba979abbb5a670279b80.exe
Size 580KB
Sample210331-stxr72lrt2
SHA256 586db0690d1fe17d41a23d8d06ad77bc62a01774b1792ea654c9fdcbe3bdbd1d
MD5 61112d94cef0ba979abbb5a670279b80
SHA1 a851759d44439fb99f73b31ac63d4f610c8b5ebb
SHA512 2160a20c72fb04fca95883fae30116f0b0ccbf4779607cdffa05b9145d2b6102f143f12b6b10196488d06473c2d0d658635122eacc8afbde703b1390084a7be2
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.privateemail.com
Port
587
Username
[email protected]
Password
Thegodfather12345

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/732-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/732-14-0x000000000043763E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
732	61112d94cef0ba979abbb5a670279b80.exe
732	61112d94cef0ba979abbb5a670279b80.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	732	61112d94cef0ba979abbb5a670279b80.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79
PID 1908 wrote to memory of 732	1908	61112d94cef0ba979abbb5a670279b80.exe	79

C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe
"C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe
  "C:\Users\Admin\AppData\Local\Temp\61112d94cef0ba979abbb5a670279b80.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-13-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/732-23-0x00000000063A0000-0x00000000063A1000-memory.dmp

Download

memory/732-22-0x0000000005C10000-0x0000000005C11000-memory.dmp

Download

memory/732-21-0x0000000005820000-0x0000000005821000-memory.dmp

Download

memory/732-16-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/1908-7-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/1908-11-0x0000000004FA0000-0x0000000004FA9000-memory.dmp

Download

memory/1908-12-0x0000000005D60000-0x0000000005DC4000-memory.dmp

Download

memory/1908-10-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/1908-9-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/1908-8-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download

memory/1908-2-0x0000000073920000-0x000000007400E000-memory.dmp

Download

memory/1908-6-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/1908-5-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Download

memory/1908-3-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download