agenttesla | 514eafb249e57467701d283fa0dea7af7c4761d6f60da2cbc7348c65e0c11501

Analysis

max time kernel
123s
max time network
113s
platform
windows10_x64
resource
win10v20210408
submitted
10/05/2021, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1272595_by_Libranalysis.exe
Size 711KB
Sample210510-ca7cffkg82
SHA256 514eafb249e57467701d283fa0dea7af7c4761d6f60da2cbc7348c65e0c11501
MD5 a127259567201bd844e1d2e947aae1a0
SHA1 52196a873cd84d04d4afcfe614255f14efdd3023
SHA512 af4b50e9cfd8f4786124529fed45695f4f74e1dd221380248b96de917112ad5496ea8293cb0a740fcad2e46248149065fbbf579526b96938d1b7e0f42ce87298
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.hybridgroupco.com
Port
587
Username
[email protected]
Password
LQWAR!ncl^vx

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3636-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3636-126-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral2/memory/3636-132-0x0000000005030000-0x000000000552E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3492 set thread context of 3636	3492	a1272595_by_Libranalysis.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3636	a1272595_by_Libranalysis.exe
3636	a1272595_by_Libranalysis.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3636	a1272595_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78
PID 3492 wrote to memory of 3636	3492	a1272595_by_Libranalysis.exe	78

C:\Users\Admin\AppData\Local\Temp\a1272595_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\a1272595_by_Libranalysis.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\a1272595_by_Libranalysis.exe
  "C:\Users\Admin\AppData\Local\Temp\a1272595_by_Libranalysis.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-119-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/3492-123-0x0000000000D10000-0x0000000000D8D000-memory.dmp

Download

memory/3492-118-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/3492-114-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/3492-120-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/3492-121-0x0000000004D80000-0x000000000527E000-memory.dmp

Download

memory/3492-117-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/3492-116-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/3492-122-0x0000000004FD0000-0x0000000004FDE000-memory.dmp

Download

memory/3492-124-0x0000000005840000-0x0000000005886000-memory.dmp

Download

memory/3636-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3636-132-0x0000000005030000-0x000000000552E000-memory.dmp

Download

memory/3636-133-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download

memory/3636-134-0x0000000005D90000-0x0000000005D91000-memory.dmp

Download