agenttesla | acd82342dc9b87abf7970edfd377c2ebe0627e688351c1ffd542827795f072d2

Analysis

max time kernel
108s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
04/08/2021, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N15KNCiLSCgssVo.exe
Size 794KB
Sample210804-c815e51bee
SHA256 acd82342dc9b87abf7970edfd377c2ebe0627e688351c1ffd542827795f072d2
MD5 d4a956722a0df1d9050377b22baa3895
SHA1 dd835bac8380fc523caf410dad61cfc1e230242f
SHA512 a5320c7b9c4785c62f4b0f5bda38605815d36baeb7bc9c82231e1a7657707ee74ea463508d6b2e10ea52e7128b78d931795bcb2427701e2af54fd3923f1913d7
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.agceram.com
Port
587
Username
[email protected]
Password
opVnsZA7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral2/memory/996-125-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/996-126-0x00000000004374DE-mapping.dmp	family_agenttesla
behavioral2/memory/996-132-0x0000000005100000-0x00000000055FE000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 996	992	N15KNCiLSCgssVo.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
996	N15KNCiLSCgssVo.exe
996	N15KNCiLSCgssVo.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	N15KNCiLSCgssVo.exe
Token: SeDebugPrivilege	996	N15KNCiLSCgssVo.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78
PID 992 wrote to memory of 996	992	N15KNCiLSCgssVo.exe	78

C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe
"C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe
  "C:\Users\Admin\AppData\Local\Temp\N15KNCiLSCgssVo.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-119-0x00000000049E0000-0x0000000004EDE000-memory.dmp

Download

memory/992-123-0x00000000071A0000-0x000000000723A000-memory.dmp

Download

memory/992-118-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/992-120-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/992-121-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/992-117-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Download

memory/992-116-0x0000000004900000-0x0000000004901000-memory.dmp

Download

memory/992-122-0x0000000004C30000-0x0000000004C3D000-memory.dmp

Download

memory/992-124-0x0000000002370000-0x00000000023AA000-memory.dmp

Download

memory/996-125-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/996-132-0x0000000005100000-0x00000000055FE000-memory.dmp

Download

memory/996-133-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

Download

memory/996-134-0x0000000005E80000-0x0000000005E81000-memory.dmp

Download