agenttesla | d45397c58036ee32b6e50ed101b9bbd4de6ca78e5cd679c11e6022f018a5229f

Analysis

max time kernel
130s
max time network
129s
platform
windows10_x64
resource
win10v20210408
submitted
18/05/2021, 11:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO.exe
Size 509KB
Sample210518-x7dee5c522
SHA256 d45397c58036ee32b6e50ed101b9bbd4de6ca78e5cd679c11e6022f018a5229f
MD5 c08451978312b1fca5e44569ced07af0
SHA1 8d9ca9f11d9cb81d85d34d3957ef2d29ad1953bf
SHA512 09a2d06fb6f5677512fa47db133a5a6dfef79c3dd84422fc69b1183cda493e57eaf87718b52eb9ab88d141832a2df7440670b86925becf7ea7df88907e0ebd3d
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.medmermer.com.tr
Port
587
Username
[email protected]
Password
563887563887563887

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1992-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/1992-126-0x000000000043763E-mapping.dmp	family_agenttesla
behavioral2/memory/1992-132-0x00000000054C0000-0x00000000059BE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 1992	648	PO.exe	77

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1992	PO.exe
1992	PO.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	PO.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1992	648	PO.exe	77
PID 648 wrote to memory of 1992	648	PO.exe	77
PID 648 wrote to memory of 1992	648	PO.exe	77
PID 648 wrote to memory of 1992	648	PO.exe	77
PID 648 wrote to memory of 1992	648	PO.exe	77
PID 648 wrote to memory of 1992	648	PO.exe	77
PID 648 wrote to memory of 1992	648	PO.exe	77
PID 648 wrote to memory of 1992	648	PO.exe	77

C:\Users\Admin\AppData\Local\Temp\PO.exe
"C:\Users\Admin\AppData\Local\Temp\PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\PO.exe
  "C:\Users\Admin\AppData\Local\Temp\PO.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-119-0x0000000004C50000-0x0000000004C51000-memory.dmp

Download

memory/648-123-0x0000000000CB0000-0x0000000000D28000-memory.dmp

Download

memory/648-118-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/648-114-0x00000000003A0000-0x00000000003A1000-memory.dmp

Download

memory/648-120-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/648-121-0x0000000004BE0000-0x0000000004C7C000-memory.dmp

Download

memory/648-117-0x0000000005220000-0x0000000005221000-memory.dmp

Download

memory/648-116-0x0000000004C80000-0x0000000004C81000-memory.dmp

Download

memory/648-122-0x0000000004EE0000-0x0000000004EE5000-memory.dmp

Download

memory/648-124-0x0000000007F10000-0x0000000007F4F000-memory.dmp

Download

memory/1992-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1992-132-0x00000000054C0000-0x00000000059BE000-memory.dmp

Download

memory/1992-133-0x00000000058F0000-0x00000000058F1000-memory.dmp

Download

memory/1992-134-0x00000000061C0000-0x00000000061C1000-memory.dmp

Download