agenttesla | d91aedf47fe0e6f8af3bbf47b4f1f79bcc7d353bda5f4a2e39e796214918f47d

Analysis

max time kernel
149s
max time network
118s
platform
windows10_x64
resource
win10v20210408
submitted
08/06/2021, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DocumentScanCopy2021_pdf.exe
Size 736KB
Sample210608-5z2ysdzmsx
SHA256 d91aedf47fe0e6f8af3bbf47b4f1f79bcc7d353bda5f4a2e39e796214918f47d
MD5 16a36bca09c09f89dfbca66a0e94dc51
SHA1 15bf54f887a3b51627c4a81b71accff42438f2d9
SHA512 841490246b619c6eee19f4db80e3061a18db5ba8c5a716f25fc6d75e1dc4c7a00e8e73d12ecc81968cefc0fb80c010f0215600696ffffee36f9622a6ba02ad15
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
flashlogisticsindia.com
Port
587
Username
[email protected]
Password
Nitu#FLi22

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3156-126-0x000000000043769E-mapping.dmp	family_agenttesla
behavioral2/memory/3156-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3156-132-0x0000000005290000-0x000000000578E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 64 set thread context of 3156	64	DocumentScanCopy2021_pdf.exe	79

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
64	DocumentScanCopy2021_pdf.exe
64	DocumentScanCopy2021_pdf.exe
3156	DocumentScanCopy2021_pdf.exe
3156	DocumentScanCopy2021_pdf.exe
3156	DocumentScanCopy2021_pdf.exe
3156	DocumentScanCopy2021_pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	DocumentScanCopy2021_pdf.exe
Token: SeDebugPrivilege	3156	DocumentScanCopy2021_pdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2092	64	DocumentScanCopy2021_pdf.exe	78
PID 64 wrote to memory of 2092	64	DocumentScanCopy2021_pdf.exe	78
PID 64 wrote to memory of 2092	64	DocumentScanCopy2021_pdf.exe	78
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79
PID 64 wrote to memory of 3156	64	DocumentScanCopy2021_pdf.exe	79

C:\Users\Admin\AppData\Local\Temp\DocumentScanCopy2021_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\DocumentScanCopy2021_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\DocumentScanCopy2021_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DocumentScanCopy2021_pdf.exe"
  2⤵
  PID:2092
- C:\Users\Admin\AppData\Local\Temp\DocumentScanCopy2021_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\DocumentScanCopy2021_pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-119-0x0000000005120000-0x00000000051BC000-memory.dmp

Download

memory/64-123-0x0000000006EE0000-0x0000000006F68000-memory.dmp

Download

memory/64-118-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/64-114-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/64-120-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/64-121-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/64-117-0x0000000005760000-0x0000000005761000-memory.dmp

Download

memory/64-116-0x00000000051C0000-0x00000000051C1000-memory.dmp

Download

memory/64-122-0x00000000054F0000-0x000000000550E000-memory.dmp

Download

memory/64-124-0x0000000009C10000-0x0000000009C5E000-memory.dmp

Download

memory/3156-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3156-132-0x0000000005290000-0x000000000578E000-memory.dmp

Download

memory/3156-133-0x0000000005430000-0x0000000005431000-memory.dmp

Download

memory/3156-134-0x0000000005F80000-0x0000000005F81000-memory.dmp

Download