agenttesla | 7bcd067c0a67a7a6e2c3f3079b626afb4f9ab1b8643b50dce1a69cd94fdab4ee

Analysis

max time kernel
149s
max time network
14s
platform
windows7_x64
resource
win7v20210408
submitted
13/05/2021, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order PO#109355______pdf_________.exe
Size 1.7MB
Sample210513-xea98tfhfa
SHA256 7bcd067c0a67a7a6e2c3f3079b626afb4f9ab1b8643b50dce1a69cd94fdab4ee
MD5 a768a5a11d5a3b006b79fa65a9e93768
SHA1 0748925d39907166cdb3796398c41d1bd9f7dd91
SHA512 17d14fa1c5d71aa5f0cbd208ddd5564cfeb759ef0b60eb51bb3cac4810387a1e78b7396751a2c91fd9180fb641211d220c90f886b4f7fdfbd8291a62aec66a01
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.lokalboyz.com
Port
587
Username
[email protected]
Password
lkEb6ovn

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/384-67-0x00000000004374BE-mapping.dmp	family_agenttesla
behavioral1/memory/384-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/384-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 384	1028	New Order PO#109355______pdf_________.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
384	New Order PO#109355______pdf_________.exe
384	New Order PO#109355______pdf_________.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	384	New Order PO#109355______pdf_________.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29
PID 1028 wrote to memory of 384	1028	New Order PO#109355______pdf_________.exe	29

C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe
"C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order PO#109355______pdf_________.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/384-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/384-70-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/1028-60-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/1028-62-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/1028-63-0x0000000000590000-0x0000000000594000-memory.dmp

Download

memory/1028-64-0x0000000005050000-0x00000000050C9000-memory.dmp

Download

memory/1028-65-0x0000000000B30000-0x0000000000B6E000-memory.dmp

Download