agenttesla | 11d04c12597ad35e1a5be1ae7cc53114fb0796812d7370dcfc21e126e8aafa80

Analysis

max time kernel
142s
max time network
113s
platform
windows10_x64
resource
win10v20210410
submitted
18/06/2021, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ_TERMS_107_10702062207_0_US.exe
Size 817KB
Sample210618-nxgf96jpj6
SHA256 11d04c12597ad35e1a5be1ae7cc53114fb0796812d7370dcfc21e126e8aafa80
MD5 e31c2e4b3ac0c48e04b7ca4b7c702a36
SHA1 7361af49a61af295dd85dceb38b83e47cc77a608
SHA512 d31fe89ebcddb569648196299ca40dec1254f605869ad12340d38424c47c1a8ab9beb5aca9b84c30ff341d7482018ae8da680691b0a3541bb5234c06b61ec6a5
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
box5363.bluehost.com
Port
587
Username
[email protected]
Password
Hajarbh@1993

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/932-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/932-126-0x0000000000436D6E-mapping.dmp	family_agenttesla
behavioral2/memory/932-132-0x00000000050C0000-0x00000000055BE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3540 set thread context of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3540	RFQ_TERMS_107_10702062207_0_US.exe
3540	RFQ_TERMS_107_10702062207_0_US.exe
932	RFQ_TERMS_107_10702062207_0_US.exe
932	RFQ_TERMS_107_10702062207_0_US.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	RFQ_TERMS_107_10702062207_0_US.exe
Token: SeDebugPrivilege	932	RFQ_TERMS_107_10702062207_0_US.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1428	3540	RFQ_TERMS_107_10702062207_0_US.exe	78
PID 3540 wrote to memory of 1428	3540	RFQ_TERMS_107_10702062207_0_US.exe	78
PID 3540 wrote to memory of 1428	3540	RFQ_TERMS_107_10702062207_0_US.exe	78
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79
PID 3540 wrote to memory of 932	3540	RFQ_TERMS_107_10702062207_0_US.exe	79

C:\Users\Admin\AppData\Local\Temp\RFQ_TERMS_107_10702062207_0_US.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_TERMS_107_10702062207_0_US.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\RFQ_TERMS_107_10702062207_0_US.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ_TERMS_107_10702062207_0_US.exe"
  2⤵
  PID:1428
- C:\Users\Admin\AppData\Local\Temp\RFQ_TERMS_107_10702062207_0_US.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ_TERMS_107_10702062207_0_US.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/932-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/932-134-0x0000000005D30000-0x0000000005D31000-memory.dmp

Download

memory/932-133-0x00000000051D0000-0x00000000051D1000-memory.dmp

Download

memory/932-132-0x00000000050C0000-0x00000000055BE000-memory.dmp

Download

memory/3540-119-0x0000000005930000-0x0000000005E2E000-memory.dmp

Download

memory/3540-122-0x00000000058F0000-0x0000000005906000-memory.dmp

Download

memory/3540-123-0x0000000006640000-0x00000000066C0000-memory.dmp

Download

memory/3540-124-0x0000000008B70000-0x0000000008BC4000-memory.dmp

Download

memory/3540-121-0x0000000005A70000-0x0000000005A71000-memory.dmp

Download

memory/3540-120-0x00000000058E0000-0x00000000058E1000-memory.dmp

Download

memory/3540-114-0x0000000000F60000-0x0000000000F61000-memory.dmp

Download

memory/3540-118-0x00000000059D0000-0x00000000059D1000-memory.dmp

Download

memory/3540-117-0x0000000005E30000-0x0000000005E31000-memory.dmp

Download

memory/3540-116-0x0000000005820000-0x0000000005821000-memory.dmp

Download