agenttesla | 36cab5247296638ca5b35c4fcf864a06452718f5bf8b72fa41a620a06d9d67f1

Analysis

max time kernel
116s
max time network
136s
platform
windows10_x64
resource
win10v20210408
submitted
19/08/2021, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
953055e0715e637ff0f7fe84b126eac9.exe
Size 506KB
Sample210819-q3f2dckz72
SHA256 36cab5247296638ca5b35c4fcf864a06452718f5bf8b72fa41a620a06d9d67f1
MD5 953055e0715e637ff0f7fe84b126eac9
SHA1 838a32b6c61b5613d8909c924a22e526f3d36040
SHA512 e8ef2e3c318bc672a9e7743d9a41d1eeead0eb4a1ce6ac3bb7568f79def1491ba17970b145bd6fe368c869eeabb594d23d1941972be0860847ae6e1466d0e7d1
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot1941938286:AAGAe0D246xCexnnIlc5tnVIKUh9X2ishD0/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2880-124-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/2880-125-0x000000000043776E-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 808 set thread context of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
808	953055e0715e637ff0f7fe84b126eac9.exe
808	953055e0715e637ff0f7fe84b126eac9.exe
2880	953055e0715e637ff0f7fe84b126eac9.exe
2880	953055e0715e637ff0f7fe84b126eac9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	808	953055e0715e637ff0f7fe84b126eac9.exe
Token: SeDebugPrivilege	2880	953055e0715e637ff0f7fe84b126eac9.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78
PID 808 wrote to memory of 2880	808	953055e0715e637ff0f7fe84b126eac9.exe	78

C:\Users\Admin\AppData\Local\Temp\953055e0715e637ff0f7fe84b126eac9.exe
"C:\Users\Admin\AppData\Local\Temp\953055e0715e637ff0f7fe84b126eac9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:808
- C:\Users\Admin\AppData\Local\Temp\953055e0715e637ff0f7fe84b126eac9.exe
  C:\Users\Admin\AppData\Local\Temp\953055e0715e637ff0f7fe84b126eac9.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-123-0x0000000007A50000-0x0000000007AAF000-memory.dmp

Download

memory/808-116-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/808-118-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/808-119-0x0000000005060000-0x000000000555E000-memory.dmp

Download

memory/808-120-0x00000000077E0000-0x00000000077E1000-memory.dmp

Download

memory/808-121-0x00000000054F0000-0x0000000005540000-memory.dmp

Download

memory/808-117-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/808-114-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/808-122-0x0000000007990000-0x0000000007991000-memory.dmp

Download

memory/2880-124-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2880-130-0x0000000005760000-0x0000000005761000-memory.dmp

Download

memory/2880-131-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/2880-132-0x0000000005C00000-0x0000000005C01000-memory.dmp

Download

memory/2880-133-0x00000000062C0000-0x00000000062C1000-memory.dmp

Download