agenttesla | 06b85bd52f36bb069b1bdf8686a2d5ef83ee5c4b1eaeab65d8483ad8f4c02c5d

Analysis

max time kernel
149s
max time network
127s
platform
windows10_x64
resource
win10v20210410
submitted
30/04/2021, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
017a3915_by_Libranalysis.exe
Size 551KB
Sample210430-w792znba6a
SHA256 06b85bd52f36bb069b1bdf8686a2d5ef83ee5c4b1eaeab65d8483ad8f4c02c5d
MD5 017a3915ee87495923f31224e09c2b75
SHA1 66fd3d765f6636ee3c15b0074a2a27af75d52521
SHA512 eb3c91d14c4ddd46de555ceefcb0be58904f42c824d80d163581bcaffc7540ffc33d8ea54a156c334c7fd0037eb25bd33bfbe565286aa849f2ebb9bbc314af71
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
XKzOC$Y7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3180-127-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral2/memory/3180-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3180-133-0x00000000050B0000-0x00000000055AE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 3180	1808	017a3915_by_Libranalysis.exe	81

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1808	017a3915_by_Libranalysis.exe
1808	017a3915_by_Libranalysis.exe
1808	017a3915_by_Libranalysis.exe
1808	017a3915_by_Libranalysis.exe
3180	017a3915_by_Libranalysis.exe
3180	017a3915_by_Libranalysis.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	017a3915_by_Libranalysis.exe
Token: SeDebugPrivilege	3180	017a3915_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2136	1808	017a3915_by_Libranalysis.exe	79
PID 1808 wrote to memory of 2136	1808	017a3915_by_Libranalysis.exe	79
PID 1808 wrote to memory of 2136	1808	017a3915_by_Libranalysis.exe	79
PID 1808 wrote to memory of 2132	1808	017a3915_by_Libranalysis.exe	80
PID 1808 wrote to memory of 2132	1808	017a3915_by_Libranalysis.exe	80
PID 1808 wrote to memory of 2132	1808	017a3915_by_Libranalysis.exe	80
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81
PID 1808 wrote to memory of 3180	1808	017a3915_by_Libranalysis.exe	81

C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe
  "C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe"
  2⤵
  PID:2136
- C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe
  "C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe"
  2⤵
  PID:2132
- C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe
  "C:\Users\Admin\AppData\Local\Temp\017a3915_by_Libranalysis.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-122-0x0000000005240000-0x000000000573E000-memory.dmp

Download

memory/1808-125-0x0000000008540000-0x000000000857F000-memory.dmp

Download

memory/1808-118-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/1808-119-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/1808-120-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/1808-121-0x0000000005470000-0x000000000547D000-memory.dmp

Download

memory/1808-117-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/1808-123-0x000000007EC50000-0x000000007EC51000-memory.dmp

Download

memory/1808-124-0x00000000011D0000-0x000000000124C000-memory.dmp

Download

memory/1808-114-0x0000000000920000-0x0000000000921000-memory.dmp

Download

memory/1808-116-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/3180-126-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3180-133-0x00000000050B0000-0x00000000055AE000-memory.dmp

Download

memory/3180-134-0x0000000005250000-0x0000000005251000-memory.dmp

Download

memory/3180-135-0x0000000005E10000-0x0000000005E11000-memory.dmp

Download