agenttesla | d649da4d6e45efc5830efb532f63e17004ce49602de831fa98f4137c756c8c1b

Analysis

max time kernel
146s
max time network
123s
platform
windows7_x64
resource
win7v20210410
submitted
03/06/2021, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Scan 03.06.2021.exe
Size 906KB
Sample210603-2se6kbd85n
SHA256 d649da4d6e45efc5830efb532f63e17004ce49602de831fa98f4137c756c8c1b
MD5 676cee7794d6bc265b653bc6e1ceedc7
SHA1 42770f9b9fead71fd2f1f575c1ce3ce61e17c5ff
SHA512 421269742b2fb395ba63a1697a65230fe2c794564e38fff4ec123a958540870cec3e328045372f4ef8196a7a7e25ec3600467b6a6f243cddb93591ded56ccb23
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.vivaldi.net
Port
587
Username
[email protected]
Password
Grace@331011Thinck

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1788-67-0x000000000043751E-mapping.dmp	family_agenttesla
behavioral1/memory/1788-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1788-68-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1788	1640	Scan 03.06.2021.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1788	Scan 03.06.2021.exe
1788	Scan 03.06.2021.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	Scan 03.06.2021.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29
PID 1640 wrote to memory of 1788	1640	Scan 03.06.2021.exe	29

C:\Users\Admin\AppData\Local\Temp\Scan 03.06.2021.exe
"C:\Users\Admin\AppData\Local\Temp\Scan 03.06.2021.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\Scan 03.06.2021.exe
  "C:\Users\Admin\AppData\Local\Temp\Scan 03.06.2021.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-60-0x0000000000030000-0x0000000000031000-memory.dmp

Download

memory/1640-62-0x0000000000540000-0x0000000000541000-memory.dmp

Download

memory/1640-63-0x0000000000660000-0x0000000000674000-memory.dmp

Download

memory/1640-64-0x0000000005030000-0x00000000050CB000-memory.dmp

Download

memory/1640-65-0x0000000005110000-0x0000000005172000-memory.dmp

Download

memory/1788-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1788-68-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1788-70-0x0000000004300000-0x0000000004301000-memory.dmp

Download