agenttesla | 1dfeef75d1a9dc01ec23c14e6bb3f26e095582bb8199958a8fec268f6370da02

Analysis

max time kernel
144s
max time network
9s
platform
windows7_x64
resource
win7v20201028
submitted
02/04/2021, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AgentTesla.exe
Size 965KB
Sample210402-3fgn9ld65n
SHA256 1dfeef75d1a9dc01ec23c14e6bb3f26e095582bb8199958a8fec268f6370da02
MD5 3070822dd911c6aa4f0139dc78e83c51
SHA1 b157a337f46440bdd97a74fe31aec5b239f080b0
SHA512 5ab80ce2976adf795189dfbdd1bf32b67bdf96bf31138b0501464732dc1d61849d85871ef41b71e6a363f50e3874d8b12bd8763ec700077f9b6c1e3b10006f42
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
computer.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1672-10-0x0000000000436DCE-mapping.dmp	family_agenttesla
behavioral1/memory/1672-9-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1672-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 1672	1852	AgentTesla.exe	29

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1852	AgentTesla.exe
1852	AgentTesla.exe
1672	AgentTesla.exe
1672	AgentTesla.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	AgentTesla.exe
Token: SeDebugPrivilege	1672	AgentTesla.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29
PID 1852 wrote to memory of 1672	1852	AgentTesla.exe	29

C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe
"C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe
  "C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1672-11-0x0000000074840000-0x0000000074F2E000-memory.dmp

Download

memory/1672-12-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1672-14-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/1852-2-0x0000000074840000-0x0000000074F2E000-memory.dmp

Download

memory/1852-3-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/1852-5-0x0000000000440000-0x000000000044C000-memory.dmp

Download

memory/1852-6-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/1852-7-0x0000000001210000-0x0000000001289000-memory.dmp

Download

memory/1852-8-0x0000000000A30000-0x0000000000A6C000-memory.dmp

Download