agenttesla | 7520c3d86fbc4b2313e8f2c0118a67e2102db4263b56ea7500dbd045d70c3914

Analysis

max time kernel
122s
max time network
111s
platform
windows10_x64
resource
win10v20210408
submitted
20/04/2021, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4cbd50e71f77d7b9068a6d1ab77974f6.exe
Size 912KB
Sample210420-csj3pt65le
SHA256 7520c3d86fbc4b2313e8f2c0118a67e2102db4263b56ea7500dbd045d70c3914
MD5 4cbd50e71f77d7b9068a6d1ab77974f6
SHA1 2fe07559ccdc7d5ba1a92b5a2df07c9eed5998e4
SHA512 4617628e84d533847e99ff90cca7d11fbffe45b010c9362bfb7c5a83716ca083d5913f6671d7f2fcc3aa85fee3c3e58d1f4a88954f33c9aefe79f84a9b6c8c03
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot1620445910:AAF2v81NoINJsu_XXnpGet1YDm-NxnznaIE/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/900-127-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral2/memory/900-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
800	4cbd50e71f77d7b9068a6d1ab77974f6.exe
800	4cbd50e71f77d7b9068a6d1ab77974f6.exe
800	4cbd50e71f77d7b9068a6d1ab77974f6.exe
900	4cbd50e71f77d7b9068a6d1ab77974f6.exe
900	4cbd50e71f77d7b9068a6d1ab77974f6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe
Token: SeDebugPrivilege	900	4cbd50e71f77d7b9068a6d1ab77974f6.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78
PID 800 wrote to memory of 900	800	4cbd50e71f77d7b9068a6d1ab77974f6.exe	78

C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe
"C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe
  "C:\Users\Admin\AppData\Local\Temp\4cbd50e71f77d7b9068a6d1ab77974f6.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-123-0x000000007F4A0000-0x000000007F4A1000-memory.dmp

Download

memory/800-125-0x00000000081B0000-0x00000000081FA000-memory.dmp

Download

memory/800-118-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/800-119-0x0000000004D30000-0x0000000004DCC000-memory.dmp

Download

memory/800-120-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/800-121-0x0000000005070000-0x0000000005071000-memory.dmp

Download

memory/800-117-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/800-122-0x0000000005940000-0x0000000005949000-memory.dmp

Download

memory/800-124-0x0000000000C50000-0x0000000000CD5000-memory.dmp

Download

memory/800-114-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/800-116-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/900-126-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/900-133-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download

memory/900-134-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/900-135-0x0000000005A40000-0x0000000005A41000-memory.dmp

Download