agenttesla | 0bd991c7063fbfb58f4d57e32b75e55729e1061110f197e2ce27468de52b6c6d

Analysis

max time kernel
144s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
09/06/2021, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4It7P3KCyYHUWHU.exe
Size 766KB
Sample210609-n5mc64ftdj
SHA256 0bd991c7063fbfb58f4d57e32b75e55729e1061110f197e2ce27468de52b6c6d
MD5 bdff3540e8d0808273c6b2190dbcf513
SHA1 6e73a70e781b56ba46b1ff20f84e87efb018c337
SHA512 a9303ea4eb1ebe2589e5e67481907c087c2c724bbd5578ce7390b9096a8e88ccbd11212254f2e4ff88238050bf660361460dda8292fb60ef1359e443842d7612
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.filtroindustrial.net
Port
587
Username
[email protected]
Password
ZcLwgOI5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3428-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3428-126-0x00000000004375EE-mapping.dmp	family_agenttesla
behavioral2/memory/3428-132-0x0000000005670000-0x0000000005B6E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1968 set thread context of 3428	1968	4It7P3KCyYHUWHU.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3428	4It7P3KCyYHUWHU.exe
3428	4It7P3KCyYHUWHU.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	4It7P3KCyYHUWHU.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79
PID 1968 wrote to memory of 3428	1968	4It7P3KCyYHUWHU.exe	79

C:\Users\Admin\AppData\Local\Temp\4It7P3KCyYHUWHU.exe
"C:\Users\Admin\AppData\Local\Temp\4It7P3KCyYHUWHU.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\4It7P3KCyYHUWHU.exe
  "C:\Users\Admin\AppData\Local\Temp\4It7P3KCyYHUWHU.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-119-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/1968-123-0x0000000007460000-0x00000000074DD000-memory.dmp

Download

memory/1968-118-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/1968-114-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/1968-120-0x0000000005920000-0x0000000005921000-memory.dmp

Download

memory/1968-121-0x0000000005560000-0x00000000055FC000-memory.dmp

Download

memory/1968-117-0x0000000005C20000-0x0000000005C21000-memory.dmp

Download

memory/1968-116-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/1968-122-0x0000000005790000-0x00000000057AE000-memory.dmp

Download

memory/1968-124-0x0000000007520000-0x0000000007560000-memory.dmp

Download

memory/3428-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3428-132-0x0000000005670000-0x0000000005B6E000-memory.dmp

Download

memory/3428-133-0x0000000005B30000-0x0000000005B31000-memory.dmp

Download

memory/3428-134-0x00000000063D0000-0x00000000063D1000-memory.dmp

Download