agenttesla | 67e900002f5cff55084abd74646c25e1d22cf652cb0142315ab4bdc2906aad53

Analysis

max time kernel
145s
max time network
124s
platform
windows7_x64
resource
win7v20210410
submitted
04/05/2021, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MZyeln5mSFOjxMx.exe
Size 702KB
Sample210504-1s3cc3phf2
SHA256 67e900002f5cff55084abd74646c25e1d22cf652cb0142315ab4bdc2906aad53
MD5 a1f21deabde4ac7fe57170410912cdd2
SHA1 9cd78ad0b7b988373870ddff2048f39bbc2a58df
SHA512 96e9ca5076696300a1621bd4cc90dba8fb589ff9cd88f44c859a4705c07ef780b16c4d47bf6d7b667f0f8172d8095eacf02061cde712a22649cff1510e06feb9
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iykmoreentrprise.org
Port
587
Username
[email protected]
Password
rwkWCM328

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/776-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/776-66-0x00000000004374EE-mapping.dmp	family_agenttesla
behavioral1/memory/776-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 788 set thread context of 776	788	MZyeln5mSFOjxMx.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
776	MZyeln5mSFOjxMx.exe
776	MZyeln5mSFOjxMx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	776	MZyeln5mSFOjxMx.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29
PID 788 wrote to memory of 776	788	MZyeln5mSFOjxMx.exe	29

C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe
"C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe
  "C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/776-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/776-69-0x0000000000630000-0x0000000000631000-memory.dmp

Download

memory/788-59-0x00000000013A0000-0x00000000013A1000-memory.dmp

Download

memory/788-61-0x0000000001240000-0x0000000001241000-memory.dmp

Download

memory/788-62-0x0000000000780000-0x000000000078E000-memory.dmp

Download

memory/788-63-0x0000000004F10000-0x0000000004F8B000-memory.dmp

Download

memory/788-64-0x00000000009A0000-0x00000000009DE000-memory.dmp

Download