agenttesla | acd82342dc9b87abf7970edfd377c2ebe0627e688351c1ffd542827795f072d2

Analysis

max time kernel
97s
max time network
44s
platform
windows7_x64
resource
win7v20210410
submitted
04/08/2021, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N15KNCiLSCgssVo.exe
Size 794KB
Sample210804-c815e51bee
SHA256 acd82342dc9b87abf7970edfd377c2ebe0627e688351c1ffd542827795f072d2
MD5 d4a956722a0df1d9050377b22baa3895
SHA1 dd835bac8380fc523caf410dad61cfc1e230242f
SHA512 a5320c7b9c4785c62f4b0f5bda38605815d36baeb7bc9c82231e1a7657707ee74ea463508d6b2e10ea52e7128b78d931795bcb2427701e2af54fd3923f1913d7
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.agceram.com
Port
587
Username
[email protected]
Password
opVnsZA7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/856-66-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral1/memory/856-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/856-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 856	1652	N15KNCiLSCgssVo.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1652	N15KNCiLSCgssVo.exe
856	N15KNCiLSCgssVo.exe
856	N15KNCiLSCgssVo.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	N15KNCiLSCgssVo.exe
Token: SeDebugPrivilege	856	N15KNCiLSCgssVo.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29
PID 1652 wrote to memory of 856	1652	N15KNCiLSCgssVo.exe	29

C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe
"C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe
  "C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/856-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/856-69-0x0000000004B10000-0x0000000004B11000-memory.dmp

Download

memory/1652-59-0x00000000009C0000-0x00000000009C1000-memory.dmp

Download

memory/1652-61-0x0000000000360000-0x0000000000361000-memory.dmp

Download

memory/1652-62-0x0000000000350000-0x000000000035D000-memory.dmp

Download

memory/1652-63-0x0000000005280000-0x000000000531A000-memory.dmp

Download

memory/1652-64-0x0000000000530000-0x000000000056A000-memory.dmp

Download