agenttesla | d442889a7d0dbc622a8082b4bfd54de6ff5fab950d2886c9c7cf58fb39b7a4ca

Analysis

max time kernel
121s
max time network
143s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
665346b3191827f5903ca8bce65fffbe.exe
Size 820KB
Sample220126-s1kstafbd7
SHA256 d442889a7d0dbc622a8082b4bfd54de6ff5fab950d2886c9c7cf58fb39b7a4ca
MD5 665346b3191827f5903ca8bce65fffbe
SHA1 fa37bb4ab3af1f811d3b2123aae190557de00d97
SHA512 3a7694614cc9dcf4f798a202982e0e6088cad04d0b6e23b975b1b8c383375317fb59eceee86be3d33ef9a634dfaf912144bc3c4c3e72a3f249f9720f361bad19
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
milax.tk
Port
587
Username
[email protected]
Password
7213575aceACE@#$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1736-123-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	665346b3191827f5903ca8bce65fffbe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 492 set thread context of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	665346b3191827f5903ca8bce65fffbe.exe
1736	665346b3191827f5903ca8bce65fffbe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	665346b3191827f5903ca8bce65fffbe.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71
PID 492 wrote to memory of 1736	492	665346b3191827f5903ca8bce65fffbe.exe	71

C:\Users\Admin\AppData\Local\Temp\665346b3191827f5903ca8bce65fffbe.exe
"C:\Users\Admin\AppData\Local\Temp\665346b3191827f5903ca8bce65fffbe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:492
- C:\Users\Admin\AppData\Local\Temp\665346b3191827f5903ca8bce65fffbe.exe
  "C:\Users\Admin\AppData\Local\Temp\665346b3191827f5903ca8bce65fffbe.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/492-115-0x00000000005C0000-0x0000000000692000-memory.dmp

Download

memory/492-116-0x0000000005690000-0x0000000005B8E000-memory.dmp

Download

memory/492-117-0x0000000005010000-0x00000000050A2000-memory.dmp

Download

memory/492-118-0x0000000002A20000-0x0000000002AB2000-memory.dmp

Download

memory/492-119-0x0000000005190000-0x000000000519A000-memory.dmp

Download

memory/492-120-0x0000000005670000-0x000000000567C000-memory.dmp

Download

memory/492-121-0x0000000007950000-0x00000000079EC000-memory.dmp

Download

memory/492-122-0x0000000007AF0000-0x0000000007B64000-memory.dmp

Download

memory/1736-123-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1736-124-0x0000000004F60000-0x0000000005121000-memory.dmp

Download

memory/1736-125-0x00000000051B0000-0x00000000051C8000-memory.dmp

Download

memory/1736-126-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download