agenttesla | 6c43ac41372f9ff91e47ffa81a9c086e16cc32014d0b6f7c4571fa31a8fecd3c

Analysis

max time kernel
150s
max time network
15s
platform
windows7_x64
resource
win7v20210408
submitted
10/05/2021, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
guluh4pYFQybxL8.exe
Size 621KB
Sample210510-c2328wtvee
SHA256 6c43ac41372f9ff91e47ffa81a9c086e16cc32014d0b6f7c4571fa31a8fecd3c
MD5 e63ed0c7946b6c89294cea0d1987b671
SHA1 c5bb5c60fc10518ba7a41b7bfe3416f926857863
SHA512 09f77190d4051ab388a3cd6d35fdeaf4b0ccf24dbac6b8db9ce8069aee0f6868eb0ed3de880915615c7523cdb9603dd71a766f86e11c03b33bc6f1d51d2d2a7f
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iykmoreentrprise.org
Port
587
Username
[email protected]
Password
rwkWCM328

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1304-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1304-67-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/1304-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1996 set thread context of 1304	1996	guluh4pYFQybxL8.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	guluh4pYFQybxL8.exe
1304	guluh4pYFQybxL8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	guluh4pYFQybxL8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29
PID 1996 wrote to memory of 1304	1996	guluh4pYFQybxL8.exe	29

C:\Users\Admin\AppData\Local\Temp\guluh4pYFQybxL8.exe
"C:\Users\Admin\AppData\Local\Temp\guluh4pYFQybxL8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\guluh4pYFQybxL8.exe
  "C:\Users\Admin\AppData\Local\Temp\guluh4pYFQybxL8.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1304-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1304-70-0x0000000004B40000-0x0000000004B41000-memory.dmp

Download

memory/1996-60-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download

memory/1996-62-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/1996-63-0x0000000000430000-0x0000000000434000-memory.dmp

Download

memory/1996-64-0x0000000004B50000-0x0000000004BC8000-memory.dmp

Download

memory/1996-65-0x00000000005A0000-0x00000000005E1000-memory.dmp

Download