agenttesla | 14b8d85d0d19f24e709e4edac6a199a6cb72ebff3fef1948b6489f31e5e268f0

Analysis

max time kernel
121s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
17/06/2021, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3ceed1956213d2e9083b2d49b9e17935.exe
Size 685KB
Sample210617-6z6exrb2rn
SHA256 14b8d85d0d19f24e709e4edac6a199a6cb72ebff3fef1948b6489f31e5e268f0
MD5 3ceed1956213d2e9083b2d49b9e17935
SHA1 9c3c270118387a38ecba016f0ace2e0136da4b4d
SHA512 5ea8c4572ca8bcc3a7273e2ea5d5ff863b8939587c717773cad726224e1948ef3c57eb91d7107a10929362aa8cb4c71f319adfb38cf5507592180e7c9c9b2bd9
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.labexpo.com
Port
587
Username
[email protected]
Password
Can#[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3460-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/3460-126-0x000000000043761E-mapping.dmp	family_agenttesla
behavioral2/memory/3460-132-0x0000000005360000-0x000000000585E000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
636	3ceed1956213d2e9083b2d49b9e17935.exe
636	3ceed1956213d2e9083b2d49b9e17935.exe
3460	3ceed1956213d2e9083b2d49b9e17935.exe
3460	3ceed1956213d2e9083b2d49b9e17935.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	636	3ceed1956213d2e9083b2d49b9e17935.exe
Token: SeDebugPrivilege	3460	3ceed1956213d2e9083b2d49b9e17935.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 628	636	3ceed1956213d2e9083b2d49b9e17935.exe	78
PID 636 wrote to memory of 628	636	3ceed1956213d2e9083b2d49b9e17935.exe	78
PID 636 wrote to memory of 628	636	3ceed1956213d2e9083b2d49b9e17935.exe	78
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79
PID 636 wrote to memory of 3460	636	3ceed1956213d2e9083b2d49b9e17935.exe	79

C:\Users\Admin\AppData\Local\Temp\3ceed1956213d2e9083b2d49b9e17935.exe
"C:\Users\Admin\AppData\Local\Temp\3ceed1956213d2e9083b2d49b9e17935.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\3ceed1956213d2e9083b2d49b9e17935.exe
  "C:\Users\Admin\AppData\Local\Temp\3ceed1956213d2e9083b2d49b9e17935.exe"
  2⤵
  PID:628
- C:\Users\Admin\AppData\Local\Temp\3ceed1956213d2e9083b2d49b9e17935.exe
  "C:\Users\Admin\AppData\Local\Temp\3ceed1956213d2e9083b2d49b9e17935.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-119-0x0000000005780000-0x0000000005C7E000-memory.dmp

Download

memory/636-123-0x0000000006500000-0x0000000006576000-memory.dmp

Download

memory/636-118-0x0000000005820000-0x0000000005821000-memory.dmp

Download

memory/636-114-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/636-120-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/636-121-0x0000000005980000-0x0000000005981000-memory.dmp

Download

memory/636-117-0x0000000005C80000-0x0000000005C81000-memory.dmp

Download

memory/636-116-0x0000000005680000-0x0000000005681000-memory.dmp

Download

memory/636-122-0x0000000005790000-0x00000000057A6000-memory.dmp

Download

memory/636-124-0x0000000005C20000-0x0000000005C69000-memory.dmp

Download

memory/3460-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3460-132-0x0000000005360000-0x000000000585E000-memory.dmp

Download

memory/3460-133-0x00000000057D0000-0x00000000057D1000-memory.dmp

Download

memory/3460-134-0x0000000005F50000-0x0000000005F51000-memory.dmp

Download