agenttesla | 1dfeef75d1a9dc01ec23c14e6bb3f26e095582bb8199958a8fec268f6370da02

Analysis

max time kernel
148s
max time network
110s
platform
windows10_x64
resource
win10v20201028
submitted
02/04/2021, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AgentTesla.exe
Size 965KB
Sample210402-3fgn9ld65n
SHA256 1dfeef75d1a9dc01ec23c14e6bb3f26e095582bb8199958a8fec268f6370da02
MD5 3070822dd911c6aa4f0139dc78e83c51
SHA1 b157a337f46440bdd97a74fe31aec5b239f080b0
SHA512 5ab80ce2976adf795189dfbdd1bf32b67bdf96bf31138b0501464732dc1d61849d85871ef41b71e6a363f50e3874d8b12bd8763ec700077f9b6c1e3b10006f42
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
computer.com

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2652-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2652-15-0x0000000000436DCE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 2652	4052	AgentTesla.exe	78

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4052	AgentTesla.exe
4052	AgentTesla.exe
4052	AgentTesla.exe
2652	AgentTesla.exe
2652	AgentTesla.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	AgentTesla.exe
Token: SeDebugPrivilege	2652	AgentTesla.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78
PID 4052 wrote to memory of 2652	4052	AgentTesla.exe	78

C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe
"C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe
  "C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2652-14-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2652-24-0x0000000005F30000-0x0000000005F31000-memory.dmp

Download

memory/2652-23-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/2652-22-0x0000000005250000-0x0000000005251000-memory.dmp

Download

memory/2652-17-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/4052-7-0x0000000005130000-0x0000000005131000-memory.dmp

Download

memory/4052-11-0x0000000005020000-0x000000000502C000-memory.dmp

Download

memory/4052-12-0x0000000005DC0000-0x0000000005E39000-memory.dmp

Download

memory/4052-13-0x00000000082F0000-0x000000000832C000-memory.dmp

Download

memory/4052-10-0x0000000005090000-0x0000000005091000-memory.dmp

Download

memory/4052-9-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/4052-8-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/4052-2-0x0000000073820000-0x0000000073F0E000-memory.dmp

Download

memory/4052-6-0x0000000005590000-0x0000000005591000-memory.dmp

Download

memory/4052-5-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/4052-3-0x0000000000640000-0x0000000000641000-memory.dmp

Download