agenttesla | 2d7312010d890025b8e61e9ed20a7e0fa79d5c97a19ddee26d7be69abaa97ca2

Analysis

max time kernel
123s
max time network
46s
platform
windows7_x64
resource
win7v20210408
submitted
22/07/2021, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER_SA.EXE
Size 737KB
Sample210722-ba11e2cs8j
SHA256 2d7312010d890025b8e61e9ed20a7e0fa79d5c97a19ddee26d7be69abaa97ca2
MD5 2567be7ed91809c33f43f1a37a3eb1ad
SHA1 0f8900de0a25353089e96e2c0c10d7f6742abd77
SHA512 5885dc0b6641660cb58270525c2467e92a7dfcf8dfdc6b7cbc5055ac97991d50c9ee333721356c37044a5b84d53f2e704ccede63b7555d5e0704d5a2d5769e4e
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.efm.de
Port
587
Username
[email protected]
Password
vb#8rot

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1212-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1212-66-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral1/memory/1212-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1644 set thread context of 1212	1644	ORDER_SA.EXE	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1212	ORDER_SA.EXE
1212	ORDER_SA.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1212	ORDER_SA.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	ORDER_SA.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29
PID 1644 wrote to memory of 1212	1644	ORDER_SA.EXE	29

C:\Users\Admin\AppData\Local\Temp\ORDER_SA.EXE
"C:\Users\Admin\AppData\Local\Temp\ORDER_SA.EXE"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\ORDER_SA.EXE
  "C:\Users\Admin\AppData\Local\Temp\ORDER_SA.EXE"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  PID:1212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1212-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1212-69-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/1644-59-0x0000000001270000-0x0000000001271000-memory.dmp

Download

memory/1644-61-0x0000000004D80000-0x0000000004D81000-memory.dmp

Download

memory/1644-62-0x0000000000600000-0x000000000061B000-memory.dmp

Download

memory/1644-63-0x0000000005EA0000-0x0000000005F22000-memory.dmp

Download

memory/1644-64-0x0000000000B00000-0x0000000000B3D000-memory.dmp

Download