agenttesla | c50594e26bf475268109c2843864ef12acaead42dba369abbff672f2e0db55bf

Analysis

max time kernel
146s
max time network
116s
platform
windows10_x64
resource
win10v20210410
submitted
16/06/2021, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c868ba6224dce05a9268a79212eb80a.exe
Size 878KB
Sample210616-ncret52xbs
SHA256 c50594e26bf475268109c2843864ef12acaead42dba369abbff672f2e0db55bf
MD5 3c868ba6224dce05a9268a79212eb80a
SHA1 cfb5e2ae4b0c8711155876d84aa223fd351ae264
SHA512 172f90917a61be5117c56c31a91f2348a8410af6cafa208b18a125a312cdb7f77c4eb1a39132e31ca1fec850b2a833d33d79cbe81c7fd20a482eb2d7328da7cc
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
romeovm2015

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3944-126-0x000000000043760E-mapping.dmp	family_agenttesla
behavioral2/memory/3944-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1872	3c868ba6224dce05a9268a79212eb80a.exe
1872	3c868ba6224dce05a9268a79212eb80a.exe
1872	3c868ba6224dce05a9268a79212eb80a.exe
3944	3c868ba6224dce05a9268a79212eb80a.exe
3944	3c868ba6224dce05a9268a79212eb80a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	3c868ba6224dce05a9268a79212eb80a.exe
Token: SeDebugPrivilege	3944	3c868ba6224dce05a9268a79212eb80a.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 3844	1872	3c868ba6224dce05a9268a79212eb80a.exe	79
PID 1872 wrote to memory of 3844	1872	3c868ba6224dce05a9268a79212eb80a.exe	79
PID 1872 wrote to memory of 3844	1872	3c868ba6224dce05a9268a79212eb80a.exe	79
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80
PID 1872 wrote to memory of 3944	1872	3c868ba6224dce05a9268a79212eb80a.exe	80

C:\Users\Admin\AppData\Local\Temp\3c868ba6224dce05a9268a79212eb80a.exe
"C:\Users\Admin\AppData\Local\Temp\3c868ba6224dce05a9268a79212eb80a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\3c868ba6224dce05a9268a79212eb80a.exe
  "C:\Users\Admin\AppData\Local\Temp\3c868ba6224dce05a9268a79212eb80a.exe"
  2⤵
  PID:3844
- C:\Users\Admin\AppData\Local\Temp\3c868ba6224dce05a9268a79212eb80a.exe
  "C:\Users\Admin\AppData\Local\Temp\3c868ba6224dce05a9268a79212eb80a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-119-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/1872-123-0x0000000006BB0000-0x0000000006C2C000-memory.dmp

Download

memory/1872-118-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download

memory/1872-114-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/1872-120-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/1872-121-0x0000000005380000-0x0000000005396000-memory.dmp

Download

memory/1872-117-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download

memory/1872-116-0x0000000004D80000-0x0000000004D81000-memory.dmp

Download

memory/1872-122-0x0000000004EB0000-0x00000000053AE000-memory.dmp

Download

memory/1872-124-0x000000000A980000-0x000000000A9C1000-memory.dmp

Download

memory/3944-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3944-132-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/3944-133-0x0000000005A70000-0x0000000005A71000-memory.dmp

Download

memory/3944-134-0x0000000006220000-0x0000000006221000-memory.dmp

Download