agenttesla | 67e900002f5cff55084abd74646c25e1d22cf652cb0142315ab4bdc2906aad53

Analysis

max time kernel
124s
max time network
109s
platform
windows10_x64
resource
win10v20210408
submitted
04/05/2021, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MZyeln5mSFOjxMx.exe
Size 702KB
Sample210504-1s3cc3phf2
SHA256 67e900002f5cff55084abd74646c25e1d22cf652cb0142315ab4bdc2906aad53
MD5 a1f21deabde4ac7fe57170410912cdd2
SHA1 9cd78ad0b7b988373870ddff2048f39bbc2a58df
SHA512 96e9ca5076696300a1621bd4cc90dba8fb589ff9cd88f44c859a4705c07ef780b16c4d47bf6d7b667f0f8172d8095eacf02061cde712a22649cff1510e06feb9
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iykmoreentrprise.org
Port
587
Username
[email protected]
Password
rwkWCM328

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2236-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2236-126-0x00000000004374EE-mapping.dmp	family_agenttesla
behavioral2/memory/2236-132-0x0000000004D80000-0x000000000527E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 640 set thread context of 2236	640	MZyeln5mSFOjxMx.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
640	MZyeln5mSFOjxMx.exe
640	MZyeln5mSFOjxMx.exe
2236	MZyeln5mSFOjxMx.exe
2236	MZyeln5mSFOjxMx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	640	MZyeln5mSFOjxMx.exe
Token: SeDebugPrivilege	2236	MZyeln5mSFOjxMx.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3296	640	MZyeln5mSFOjxMx.exe	78
PID 640 wrote to memory of 3296	640	MZyeln5mSFOjxMx.exe	78
PID 640 wrote to memory of 3296	640	MZyeln5mSFOjxMx.exe	78
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79
PID 640 wrote to memory of 2236	640	MZyeln5mSFOjxMx.exe	79

C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe
"C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe
  "C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe"
  2⤵
  PID:3296
- C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe
  "C:\Users\Admin\AppData\Local\Temp\MZyeln5mSFOjxMx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-119-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/640-123-0x0000000000BC0000-0x0000000000C3B000-memory.dmp

Download

memory/640-118-0x0000000004D80000-0x0000000004D81000-memory.dmp

Download

memory/640-114-0x0000000000380000-0x0000000000381000-memory.dmp

Download

memory/640-120-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download

memory/640-121-0x0000000004CE0000-0x00000000051DE000-memory.dmp

Download

memory/640-117-0x00000000051E0000-0x00000000051E1000-memory.dmp

Download

memory/640-116-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/640-122-0x0000000004F40000-0x0000000004F4E000-memory.dmp

Download

memory/640-124-0x0000000005170000-0x00000000051AE000-memory.dmp

Download

memory/2236-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2236-132-0x0000000004D80000-0x000000000527E000-memory.dmp

Download

memory/2236-133-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/2236-134-0x0000000005A70000-0x0000000005A71000-memory.dmp

Download