agenttesla | 5776326232f8948c3e3bbbbb80ff0b1f50fc12df854c6eec11af2d4a0a9666f2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7v20210410
submitted
05/07/2021, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PEDIDOS RETRASADOS.exe
Size 1.0MB
Sample210705-421tmwvxka
SHA256 5776326232f8948c3e3bbbbb80ff0b1f50fc12df854c6eec11af2d4a0a9666f2
MD5 9f6e828e2b53b57f05701ee7aa81cacf
SHA1 9e97a04afb69edaba5d444f1163eac0fba23f901
SHA512 bf503c21c70482caa86ec223a0879f26b03ad5c3fc8d7369334a979fde9b7640d9203d4c2417d7bbf6eb5eb398942c66f56f26803fbcf672db8ecacd9ba947b7
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.tccinfaes.com
Port
587
Username
[email protected]
Password
transportes

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/748-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/748-66-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral1/memory/748-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1040 set thread context of 748	1040	PEDIDOS RETRASADOS.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
748	PEDIDOS RETRASADOS.exe
748	PEDIDOS RETRASADOS.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	PEDIDOS RETRASADOS.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29
PID 1040 wrote to memory of 748	1040	PEDIDOS RETRASADOS.exe	29

C:\Users\Admin\AppData\Local\Temp\PEDIDOS RETRASADOS.exe
"C:\Users\Admin\AppData\Local\Temp\PEDIDOS RETRASADOS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Users\Admin\AppData\Local\Temp\PEDIDOS RETRASADOS.exe
  "C:\Users\Admin\AppData\Local\Temp\PEDIDOS RETRASADOS.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/748-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/748-69-0x0000000004990000-0x0000000004991000-memory.dmp

Download

memory/1040-59-0x0000000010A50000-0x0000000010A51000-memory.dmp

Download

memory/1040-61-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/1040-62-0x0000000000380000-0x000000000038F000-memory.dmp

Download

memory/1040-63-0x00000000051D0000-0x000000000524F000-memory.dmp

Download

memory/1040-64-0x0000000005450000-0x00000000054A1000-memory.dmp

Download