agenttesla | 7d65371ce1f6ca3aae8d83206cc3484b54722f3993e94a2339482a02b3d94be7

Analysis

max time kernel
101s
max time network
41s
platform
windows7_x64
resource
win7v20210410
submitted
10/08/2021, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VIETNAMESE HCU23123.exe
Size 1.2MB
Sample210810-rdm34c87cx
SHA256 7d65371ce1f6ca3aae8d83206cc3484b54722f3993e94a2339482a02b3d94be7
MD5 fa1cf337d1d5acc084248b115f985984
SHA1 31e946e66637e1471b3a1f1f167abbea960f8bf2
SHA512 d604cd2506141a4556a056498e82bcf19f5180bacb3df40df10888488093a750aaebfddf1550c306526ae991ec2cceca384af75282cd8b059bcc8275f3ea84a0
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.scriptcopy.org
Port
587
Username
[email protected]
Password
t%K@flX5~T45

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 3 IoCs

resource	yara_rule
behavioral1/memory/472-66-0x000000000043764E-mapping.dmp	family_agenttesla
behavioral1/memory/472-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/472-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/1036-62-0x00000000002C0000-0x00000000002CB000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 472	1036	VIETNAMESE HCU23123.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1036	VIETNAMESE HCU23123.exe
472	VIETNAMESE HCU23123.exe
472	VIETNAMESE HCU23123.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	VIETNAMESE HCU23123.exe
Token: SeDebugPrivilege	472	VIETNAMESE HCU23123.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29
PID 1036 wrote to memory of 472	1036	VIETNAMESE HCU23123.exe	29

C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe
"C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe
  "C:\Users\Admin\AppData\Local\Temp\VIETNAMESE HCU23123.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/472-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/472-69-0x0000000004E80000-0x0000000004E81000-memory.dmp

Download

memory/1036-59-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/1036-61-0x0000000004E10000-0x0000000004E11000-memory.dmp

Download

memory/1036-62-0x00000000002C0000-0x00000000002CB000-memory.dmp

Download

memory/1036-63-0x0000000004F70000-0x0000000004FEC000-memory.dmp

Download

memory/1036-64-0x0000000000B60000-0x0000000000B9D000-memory.dmp

Download