agenttesla | c0e4dcda04ddac9d111ae112d8cb134ed18c5eb060fa0d7073c34d47e6c6f86d

Analysis

max time kernel
143s
max time network
119s
platform
windows7_x64
resource
win7v20210410
submitted
10/05/2021, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
YDHhjjAEFbel88t.exe
Size 628KB
Sample210510-np7394wr4e
SHA256 c0e4dcda04ddac9d111ae112d8cb134ed18c5eb060fa0d7073c34d47e6c6f86d
MD5 0b32b3b4fc32f018fdc9c798424028ab
SHA1 b5432e8e4d7478885ed6bf544bc4752e975cacfa
SHA512 f9dd77aaefe5a642a84a23c460f80eb1d6b8e044d22ef9d57e46da1a28ed7ca209c7d1435a9f2f782b20dcb730fe089c82e4845d6124889ac3da7ed1beda3bd7
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.iymorenterprizelogs.com
Port
587
Username
[email protected]
Password
nxLq9soWurW3

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/972-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/972-67-0x00000000004374CE-mapping.dmp	family_agenttesla
behavioral1/memory/972-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 972	1688	YDHhjjAEFbel88t.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
972	YDHhjjAEFbel88t.exe
972	YDHhjjAEFbel88t.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	YDHhjjAEFbel88t.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29
PID 1688 wrote to memory of 972	1688	YDHhjjAEFbel88t.exe	29

C:\Users\Admin\AppData\Local\Temp\YDHhjjAEFbel88t.exe
"C:\Users\Admin\AppData\Local\Temp\YDHhjjAEFbel88t.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\YDHhjjAEFbel88t.exe
  "C:\Users\Admin\AppData\Local\Temp\YDHhjjAEFbel88t.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/972-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/972-70-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/1688-60-0x00000000013A0000-0x00000000013A1000-memory.dmp

Download

memory/1688-63-0x0000000000480000-0x0000000000484000-memory.dmp

Download

memory/1688-62-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/1688-64-0x0000000004C50000-0x0000000004CCB000-memory.dmp

Download

memory/1688-65-0x0000000000E90000-0x0000000000ED1000-memory.dmp

Download