agenttesla | d3bee5348b0108ed67db1d364f29d51a4b0f119cdf45e7b7c414b49e55eeb548

Analysis

max time kernel
145s
max time network
110s
platform
windows10_x64
resource
win10v20210410
submitted
24/05/2021, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Notification.exe
Size 887KB
Sample210524-234bbzkfkn
SHA256 d3bee5348b0108ed67db1d364f29d51a4b0f119cdf45e7b7c414b49e55eeb548
MD5 6d8a64fa399036f825d2210cbb54862b
SHA1 719feeeb8a45f74abe6b0376090ce034e5497f14
SHA512 b8faa8cf83cb06574b3b40ebaaa60b9352bbd179de5f12d8e9ccee2b5346e0db742a1460b2cb691dbbbf39c98f12a5689d26a1799eef7265ff0890004fd070a5
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
zstcznz.org
Port
587
Username
[email protected]
Password
makonyo@2017

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3276-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3276-126-0x00000000004374EE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3896 set thread context of 3276	3896	Payment Notification.exe	82

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3896	Payment Notification.exe
3896	Payment Notification.exe
3896	Payment Notification.exe
3896	Payment Notification.exe
3896	Payment Notification.exe
3896	Payment Notification.exe
3276	Payment Notification.exe
3276	Payment Notification.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	Payment Notification.exe
Token: SeDebugPrivilege	3276	Payment Notification.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 2668	3896	Payment Notification.exe	79
PID 3896 wrote to memory of 2668	3896	Payment Notification.exe	79
PID 3896 wrote to memory of 2668	3896	Payment Notification.exe	79
PID 3896 wrote to memory of 2500	3896	Payment Notification.exe	80
PID 3896 wrote to memory of 2500	3896	Payment Notification.exe	80
PID 3896 wrote to memory of 2500	3896	Payment Notification.exe	80
PID 3896 wrote to memory of 2764	3896	Payment Notification.exe	81
PID 3896 wrote to memory of 2764	3896	Payment Notification.exe	81
PID 3896 wrote to memory of 2764	3896	Payment Notification.exe	81
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82
PID 3896 wrote to memory of 3276	3896	Payment Notification.exe	82

C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"
  2⤵
  PID:2764
- C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment Notification.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3276-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3276-134-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

Download

memory/3276-133-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/3276-132-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Download

memory/3896-119-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/3896-121-0x00000000050F0000-0x00000000055EE000-memory.dmp

Download

memory/3896-123-0x0000000005F40000-0x0000000005FEE000-memory.dmp

Download

memory/3896-124-0x00000000084A0000-0x0000000008513000-memory.dmp

Download

memory/3896-122-0x000000007E900000-0x000000007E901000-memory.dmp

Download

memory/3896-120-0x0000000005450000-0x0000000005455000-memory.dmp

Download

memory/3896-114-0x0000000000860000-0x0000000000861000-memory.dmp

Download

memory/3896-118-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/3896-117-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/3896-116-0x00000000055F0000-0x00000000055F1000-memory.dmp

Download