agenttesla | ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def

Analysis

max time kernel
144s
max time network
129s
platform
windows10_x64
resource
win10v20210410
submitted
29/04/2021, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order89.exe
Size 902KB
Sample210429-kmbppj7r1a
SHA256 ab0ffcb1f044952bf2d71c463e4a2858905c974b6302cab8e8b29d81fc268def
MD5 e866ca46f6ce4cb75fcf9470236b0b13
SHA1 d0f68436a7dfea84da2b6b7af70bac36df6ffadb
SHA512 e23e9baab8a2cda228ec0c9dff234df995d104c3d2828a757e9937eae2eba38aa5c8e530241696d998063109aeab9575dc1da7b899c3ab4a0bd528d75018adb9
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.skintechpharmgroup.com
Port
587
Username
[email protected]
Password
RUT!ZR^9

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3304-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3304-126-0x000000000043789E-mapping.dmp	family_agenttesla
behavioral2/memory/3304-132-0x0000000005070000-0x000000000556E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 3304	1808	Purchase Order89.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	Purchase Order89.exe
3304	Purchase Order89.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3304	Purchase Order89.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	Purchase Order89.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79
PID 1808 wrote to memory of 3304	1808	Purchase Order89.exe	79

C:\Users\Admin\AppData\Local\Temp\Purchase Order89.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order89.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\Purchase Order89.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order89.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-119-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Download

memory/1808-123-0x0000000007230000-0x00000000072B1000-memory.dmp

Download

memory/1808-118-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download

memory/1808-114-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/1808-120-0x0000000005450000-0x0000000005451000-memory.dmp

Download

memory/1808-121-0x00000000053B0000-0x00000000058AE000-memory.dmp

Download

memory/1808-117-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download

memory/1808-116-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/1808-122-0x0000000007930000-0x000000000793D000-memory.dmp

Download

memory/1808-124-0x0000000001380000-0x00000000013C6000-memory.dmp

Download

memory/3304-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3304-132-0x0000000005070000-0x000000000556E000-memory.dmp

Download

memory/3304-133-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/3304-134-0x0000000005DE0000-0x0000000005DE1000-memory.dmp

Download