agenttesla | 1de76edc36df8fc966ce695474bfdb15e937610ad67deef22ae699695e185a76

General

Target
proforma invoice.exe
Size 490KB
Sample210726-5r9tkfthy2
SHA256 1de76edc36df8fc966ce695474bfdb15e937610ad67deef22ae699695e185a76
MD5 abf840926f297ae1783d26179435a7c7
SHA1 a987cba29f906967b5f84803b1e1594d10e09da9
SHA512 26c732bb6357745705606ea0b63bf3dd5b58db5b911e66a54fbfbcc32ea94876cfc142eed9a39f629f2a005caa4a25304a0433de6defecf686aed67bfe27723f
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.framafilms.com
Port
587
Username
[email protected]
Password
lister11

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral1/memory/468-62-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/468-63-0x00000000004374EE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 288 set thread context of 468	288	proforma invoice.exe	30

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
288	proforma invoice.exe
288	proforma invoice.exe
468	RegSvcs.exe
468	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
888	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	288	proforma invoice.exe
Token: SeDebugPrivilege	468	RegSvcs.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 652	288	proforma invoice.exe	29
PID 288 wrote to memory of 652	288	proforma invoice.exe	29
PID 288 wrote to memory of 652	288	proforma invoice.exe	29
PID 288 wrote to memory of 652	288	proforma invoice.exe	29
PID 288 wrote to memory of 652	288	proforma invoice.exe	29
PID 288 wrote to memory of 652	288	proforma invoice.exe	29
PID 288 wrote to memory of 652	288	proforma invoice.exe	29
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 288 wrote to memory of 468	288	proforma invoice.exe	30
PID 468 wrote to memory of 888	468	RegSvcs.exe	31
PID 468 wrote to memory of 888	468	RegSvcs.exe	31
PID 468 wrote to memory of 888	468	RegSvcs.exe	31
PID 468 wrote to memory of 888	468	RegSvcs.exe	31

C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe
"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  PID:652
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:468
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 520
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/288-59-0x00000000753E1000-0x00000000753E3000-memory.dmp

Download

memory/288-60-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/288-61-0x0000000000C01000-0x0000000000C02000-memory.dmp

Download

memory/468-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/468-65-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/888-68-0x0000000001E90000-0x0000000001E91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads