agenttesla | e0cfb9e16d1bd4989f318107c8716a001558a751d41b60a04fda471dd4fcbf53

Analysis

max time kernel
148s
max time network
89s
platform
windows7_x64
resource
win7v20210408
submitted
13/07/2021, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quotation 2000051165.exe
Size 793KB
Sample210713-c71a67b64e
SHA256 e0cfb9e16d1bd4989f318107c8716a001558a751d41b60a04fda471dd4fcbf53
MD5 4a4e299b312966879a7c32c6dab7bd79
SHA1 0beff6757c620dcfc59e0e521b1e8c9bdf4eb94d
SHA512 2c47cba8951f769a097c604308004c4cadbfdafa73b0ee3e4e9db3a6a865f26e9da57eec26b204bb187499bcef422e7e9231cad45003a08657d889f961d36496
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.ombakparadise.com
Port
587
Username
[email protected]
Password
ce$%^mirah

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1200-63-0x000000000043781E-mapping.dmp	family_agenttesla
behavioral1/memory/1200-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 1200	1028	Quotation 2000051165.exe	29

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1416	dw20.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1028 wrote to memory of 1200	1028	Quotation 2000051165.exe	29
PID 1200 wrote to memory of 1416	1200	RegSvcs.exe	30
PID 1200 wrote to memory of 1416	1200	RegSvcs.exe	30
PID 1200 wrote to memory of 1416	1200	RegSvcs.exe	30
PID 1200 wrote to memory of 1416	1200	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\Quotation 2000051165.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation 2000051165.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 392
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-60-0x00000000750C1000-0x00000000750C3000-memory.dmp

Download

memory/1028-61-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1028-67-0x0000000000181000-0x0000000000182000-memory.dmp

Download

memory/1200-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1200-68-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/1416-69-0x0000000002390000-0x0000000002391000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads