agenttesla | 418b8285d8a2e7129052ca76c5f30243713e543ee94b603cc71858566d15e50b

Analysis

max time kernel
150s
max time network
123s
platform
windows10_x64
resource
win10v20210410
submitted
20/05/2021, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70LT1PeYjLyvKWV.exe
Size 510KB
Sample210520-srvyv3jzka
SHA256 418b8285d8a2e7129052ca76c5f30243713e543ee94b603cc71858566d15e50b
MD5 b1f71fa691b4d4d3e59e3e2dc2cba9b1
SHA1 bf3bf454402888ee234c7a12d921b402d50ca3ff
SHA512 a14c28b1548c5d657b63bfd11345fcfceaf49ae5b1fdccb73a1f480d9c6bcf71b96ef97fafdd0bed6a2483dc8a7db26bdf64f7c2b5fe837954f251a5b691c386
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
webmail.emirtecnt.com
Port
587
Username
[email protected]
Password
BLESSINGSFOLLOWUS@2021

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3616-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3616-126-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral2/memory/3616-132-0x00000000054B0000-0x00000000059AE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 3616	2256	70LT1PeYjLyvKWV.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3616	70LT1PeYjLyvKWV.exe
3616	70LT1PeYjLyvKWV.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	70LT1PeYjLyvKWV.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79
PID 2256 wrote to memory of 3616	2256	70LT1PeYjLyvKWV.exe	79

C:\Users\Admin\AppData\Local\Temp\70LT1PeYjLyvKWV.exe
"C:\Users\Admin\AppData\Local\Temp\70LT1PeYjLyvKWV.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\70LT1PeYjLyvKWV.exe
  "C:\Users\Admin\AppData\Local\Temp\70LT1PeYjLyvKWV.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2256-119-0x00000000054E0000-0x00000000054E1000-memory.dmp

Download

memory/2256-123-0x0000000001430000-0x00000000014A9000-memory.dmp

Download

memory/2256-118-0x0000000005540000-0x0000000005541000-memory.dmp

Download

memory/2256-114-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/2256-120-0x0000000005700000-0x0000000005701000-memory.dmp

Download

memory/2256-121-0x0000000005530000-0x0000000005535000-memory.dmp

Download

memory/2256-117-0x00000000059A0000-0x00000000059A1000-memory.dmp

Download

memory/2256-116-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download

memory/2256-122-0x00000000054A0000-0x000000000599E000-memory.dmp

Download

memory/2256-124-0x00000000010A0000-0x00000000010E0000-memory.dmp

Download

memory/3616-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3616-132-0x00000000054B0000-0x00000000059AE000-memory.dmp

Download

memory/3616-133-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/3616-134-0x00000000061A0000-0x00000000061A1000-memory.dmp

Download