agenttesla | a66877e631e722669c764b871db7dd41b2eceb6a6a76d22680ebb685bd4332c4

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7v20210408
submitted
16/04/2021, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DHL Delivery Document.exe
Size 975KB
Sample210416-ejhbf624be
SHA256 a66877e631e722669c764b871db7dd41b2eceb6a6a76d22680ebb685bd4332c4
MD5 4a018b91b83aa7cedf4585383e77ef42
SHA1 0b73a1609c7c31f2fd6e180fcbbcae54a2058602
SHA512 e6521a423d281078361d63f6ba18722395624ac350a1186eb7e82a80f78a170cfd9081ab828ff6820410209a6fac4c9b42489dfe5313dff58154ce9acd662f71
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
kerekesfoto.com
Port
587
Username
[email protected]
Password
beDdUo*OeKkf

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/640-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/640-67-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral1/memory/640-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1348 set thread context of 640	1348	DHL Delivery Document.exe	29

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1348	DHL Delivery Document.exe
1348	DHL Delivery Document.exe
640	DHL Delivery Document.exe
640	DHL Delivery Document.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	DHL Delivery Document.exe
Token: SeDebugPrivilege	640	DHL Delivery Document.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29
PID 1348 wrote to memory of 640	1348	DHL Delivery Document.exe	29

C:\Users\Admin\AppData\Local\Temp\DHL Delivery Document.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Document.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\DHL Delivery Document.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL Delivery Document.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/640-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/640-70-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/1348-60-0x0000000000E40000-0x0000000000E41000-memory.dmp

Download

memory/1348-62-0x0000000000500000-0x0000000000509000-memory.dmp

Download

memory/1348-63-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/1348-64-0x00000000047E0000-0x0000000004862000-memory.dmp

Download

memory/1348-65-0x0000000000C60000-0x0000000000CA8000-memory.dmp

Download