agenttesla | 7295a582fe88bca9f42f2849c9d40ceeff3006c1911dbb08e6ecf02f20cfa60a

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7v20210410
submitted
11/05/2021, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
#3001470.exe
Size 827KB
Sample210511-3tkhesvr12
SHA256 7295a582fe88bca9f42f2849c9d40ceeff3006c1911dbb08e6ecf02f20cfa60a
MD5 f92a3467a738bf01d029db773b5dc867
SHA1 b691be8d760aa3f4e932baff1295573ac50de770
SHA512 083516dc182e5f9c00f161f2a82622692c1a624da595fe62109e03b4dae87750c4dc3077fa812a358b34f2517fb28005a92648773eaf84c9653f041e9a037d8b
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.quickastmaker.in
Port
587
Username
[email protected]
Password
admin123

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/728-66-0x00000000004375FE-mapping.dmp	family_agenttesla
behavioral1/memory/728-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/728-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1272 set thread context of 728	1272	#3001470.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
728	#3001470.exe
728	#3001470.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	728	#3001470.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29
PID 1272 wrote to memory of 728	1272	#3001470.exe	29

C:\Users\Admin\AppData\Local\Temp\#3001470.exe
"C:\Users\Admin\AppData\Local\Temp\#3001470.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\#3001470.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/728-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/728-69-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/1272-59-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/1272-61-0x00000000071F0000-0x00000000071F1000-memory.dmp

Download

memory/1272-62-0x00000000003E0000-0x00000000003EE000-memory.dmp

Download

memory/1272-63-0x0000000004BA0000-0x0000000004C39000-memory.dmp

Download

memory/1272-64-0x0000000004A20000-0x0000000004A73000-memory.dmp

Download