agenttesla | 7520c3d86fbc4b2313e8f2c0118a67e2102db4263b56ea7500dbd045d70c3914

General

Target
4cbd50e71f77d7b9068a6d1ab77974f6.exe
Size 912KB
Sample210420-csj3pt65le
SHA256 7520c3d86fbc4b2313e8f2c0118a67e2102db4263b56ea7500dbd045d70c3914
MD5 4cbd50e71f77d7b9068a6d1ab77974f6
SHA1 2fe07559ccdc7d5ba1a92b5a2df07c9eed5998e4
SHA512 4617628e84d533847e99ff90cca7d11fbffe45b010c9362bfb7c5a83716ca083d5913f6671d7f2fcc3aa85fee3c3e58d1f4a88954f33c9aefe79f84a9b6c8c03
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/304-68-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral1/memory/304-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/304-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe
1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe
1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe
304	4cbd50e71f77d7b9068a6d1ab77974f6.exe
304	4cbd50e71f77d7b9068a6d1ab77974f6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe
Token: SeDebugPrivilege	304	4cbd50e71f77d7b9068a6d1ab77974f6.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1120	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	29
PID 1688 wrote to memory of 1120	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	29
PID 1688 wrote to memory of 1120	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	29
PID 1688 wrote to memory of 1120	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	29
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30
PID 1688 wrote to memory of 304	1688	4cbd50e71f77d7b9068a6d1ab77974f6.exe	30

C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe
"C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe
  "C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe"
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe
  "C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/304-69-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/304-71-0x0000000000760000-0x0000000000761000-memory.dmp

Download

memory/1688-60-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/1688-62-0x0000000001FF0000-0x0000000001FF9000-memory.dmp

Download

memory/1688-63-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/1688-64-0x000000007EF40000-0x000000007EF41000-memory.dmp

Download

memory/1688-65-0x0000000005210000-0x0000000005295000-memory.dmp

Download

memory/1688-66-0x0000000002170000-0x00000000021BA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads