agenttesla | f88ec019aae2911745ec7982ec4205624b91b72b8c243f0ff70b43931b7f2ee5

General

Target

Curriculum Vitae.exe
Size

401KB
MD5

e9a2e9f1ed8575797604981d5044e140
SHA1

490c2170713f8aec885ae67f5e9dbce7dcba24a7
SHA256

0283cabedfe0c400c64023384f84b80c7c289dd509f61b8aaded1d57ec61cab0
SHA512

328a2e366c7d8b2bf01562b2a3917ce35e46ac720d07f62a3401a7b9251ce75c687b98083b995e3f22c08b2fc3697c653d85f98ef61656962fe142ca7caa3dd7

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.ofilsysterns.com
Port:
587
Username:
[email protected]
Password:
@o^M)K*1

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/896-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral2/memory/896-127-0x00000000004374CE-mapping.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

Curriculum Vitae.exe

description pid process target process

PID 2720 set thread context of 896 2720 Curriculum Vitae.exe Curriculum Vitae.exe

description	pid	process	target process
PID 2720 set thread context of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

Curriculum Vitae.exeCurriculum Vitae.exe

pid	process
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
2720	Curriculum Vitae.exe
896	Curriculum Vitae.exe
896	Curriculum Vitae.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Curriculum Vitae.exeCurriculum Vitae.exe

description pid process

Token: SeDebugPrivilege 2720 Curriculum Vitae.exe
Token: SeDebugPrivilege 896 Curriculum Vitae.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Curriculum Vitae.exe

pid process

2720 Curriculum Vitae.exe
2720 Curriculum Vitae.exe

description	pid	process
Token: SeDebugPrivilege	2720	Curriculum Vitae.exe
Token: SeDebugPrivilege	896	Curriculum Vitae.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Curriculum Vitae.exe

description	pid	process	target process
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe
PID 2720 wrote to memory of 896	2720	Curriculum Vitae.exe	Curriculum Vitae.exe

C:\Users\Admin\AppData\Local\Temp\Curriculum Vitae.exe
"C:\Users\Admin\AppData\Local\Temp\Curriculum Vitae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720

C:\Users\Admin\AppData\Local\Temp\Curriculum Vitae.exe
"C:\Users\Admin\AppData\Local\Temp\Curriculum Vitae.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Curriculum Vitae.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
memory/896-126-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/896-135-0x0000000005F10000-0x0000000005F11000-memory.dmp

Filesize
4KB

Download
memory/896-134-0x0000000005E70000-0x0000000005E71000-memory.dmp

Filesize
4KB

Download
memory/896-133-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/896-127-0x00000000004374CE-mapping.dmp

Download
memory/2720-120-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/2720-123-0x00000000090E0000-0x00000000090E8000-memory.dmp

Filesize
32KB

Download
memory/2720-124-0x00000000091A0000-0x00000000091A1000-memory.dmp

Filesize
4KB

Download
memory/2720-125-0x0000000009240000-0x0000000009298000-memory.dmp

Filesize
352KB

Download
memory/2720-122-0x0000000004C70000-0x000000000516E000-memory.dmp

Filesize
5.0MB

Download
memory/2720-121-0x0000000004C70000-0x000000000516E000-memory.dmp

Filesize
5.0MB

Download
memory/2720-115-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2720-119-0x0000000004C70000-0x000000000516E000-memory.dmp

Filesize
5.0MB

Download
memory/2720-118-0x0000000004D10000-0x0000000004D11000-memory.dmp

Filesize
4KB

Download
memory/2720-117-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads