agenttesla | 76c62f1e40aeb26bd5bbcf40f7f73894316433e9bb7c577ced6c266d9ff72344

Analysis

max time kernel
146s
max time network
66s
platform
windows10_x64
resource
win10v20210408
submitted
27/05/2021, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f7dab2799b7f32da668e6725f38f3f1.exe
Size 722KB
Sample210527-d2zxpvp2ss
SHA256 76c62f1e40aeb26bd5bbcf40f7f73894316433e9bb7c577ced6c266d9ff72344
MD5 6f7dab2799b7f32da668e6725f38f3f1
SHA1 f2437530a0ba10310bf4a28e8f987e09d2150179
SHA512 229e023e2aec7ae85d0980398eb10cc04994b3c68c27a8fe9bc65a57c7b03f3c7a10d144fa597f43386f7bf91458591c03cd38d332f899b99bfc911fda9d6689
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.mytravelws.com
Port
587
Username
[email protected]
Password
hbhf@--8hyhb#E6g

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/760-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/760-126-0x000000000043768E-mapping.dmp	family_agenttesla
behavioral2/memory/760-132-0x00000000050C0000-0x00000000055BE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
760	6f7dab2799b7f32da668e6725f38f3f1.exe
760	6f7dab2799b7f32da668e6725f38f3f1.exe
760	6f7dab2799b7f32da668e6725f38f3f1.exe
760	6f7dab2799b7f32da668e6725f38f3f1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	6f7dab2799b7f32da668e6725f38f3f1.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78
PID 632 wrote to memory of 760	632	6f7dab2799b7f32da668e6725f38f3f1.exe	78

C:\Users\Admin\AppData\Local\Temp\6f7dab2799b7f32da668e6725f38f3f1.exe
"C:\Users\Admin\AppData\Local\Temp\6f7dab2799b7f32da668e6725f38f3f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\6f7dab2799b7f32da668e6725f38f3f1.exe
  "C:\Users\Admin\AppData\Local\Temp\6f7dab2799b7f32da668e6725f38f3f1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-119-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/632-123-0x0000000005AF0000-0x0000000005B6D000-memory.dmp

Download

memory/632-118-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download

memory/632-114-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/632-121-0x0000000005050000-0x0000000005051000-memory.dmp

Download

memory/632-120-0x0000000004DF0000-0x00000000052EE000-memory.dmp

Download

memory/632-117-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/632-116-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

memory/632-122-0x0000000004E10000-0x0000000004E14000-memory.dmp

Download

memory/632-124-0x0000000008060000-0x00000000080A0000-memory.dmp

Download

memory/760-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/760-132-0x00000000050C0000-0x00000000055BE000-memory.dmp

Download

memory/760-133-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/760-134-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

Download