agenttesla | 4601621cfda56bc05c74eb9e906d082fe613dedbdd07fcec0dc9ba02e3f37a00

Analysis

max time kernel
142s
max time network
155s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/01/2022, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
solo.exe
Size 846KB
Sample220128-vcwxaaggbp
SHA256 4601621cfda56bc05c74eb9e906d082fe613dedbdd07fcec0dc9ba02e3f37a00
MD5 509c2c9cf7e281ddde8289d7d9c1a14a
SHA1 f96470590239cf2b0581587a1237d420bfe8f456
SHA512 d9f14c9410395423bc8b4bc9f2acad6a7069eba710840fcda71215db3c4726766e5554dd596b0e8649b63fd3ee1331f9a1f50b23d16b0001979c07d67e259dba
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
n(aGI^pW6

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2684-126-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 648 set thread context of 2684	648	solo.exe	71

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
648	solo.exe
648	solo.exe
2684	solo.exe
2684	solo.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	solo.exe
Token: SeDebugPrivilege	2684	solo.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 2684	648	solo.exe	71
PID 648 wrote to memory of 2684	648	solo.exe	71
PID 648 wrote to memory of 2684	648	solo.exe	71
PID 648 wrote to memory of 2684	648	solo.exe	71
PID 648 wrote to memory of 2684	648	solo.exe	71
PID 648 wrote to memory of 2684	648	solo.exe	71
PID 648 wrote to memory of 2684	648	solo.exe	71
PID 648 wrote to memory of 2684	648	solo.exe	71

C:\Users\Admin\AppData\Local\Temp\solo.exe
"C:\Users\Admin\AppData\Local\Temp\solo.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\solo.exe
  "C:\Users\Admin\AppData\Local\Temp\solo.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-121-0x0000000004C20000-0x000000000511E000-memory.dmp

Download

memory/648-120-0x0000000004B00000-0x0000000004B92000-memory.dmp

Download

memory/648-118-0x00000000001B0000-0x000000000028C000-memory.dmp

Download

memory/648-122-0x0000000004AD0000-0x0000000004ADA000-memory.dmp

Download

memory/648-123-0x0000000004D20000-0x0000000004D2C000-memory.dmp

Download

memory/648-124-0x00000000009D0000-0x0000000000A6C000-memory.dmp

Download

memory/648-125-0x0000000007510000-0x0000000007580000-memory.dmp

Download

memory/648-119-0x0000000005120000-0x000000000561E000-memory.dmp

Download

memory/2684-126-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2684-128-0x0000000005000000-0x00000000050A0000-memory.dmp

Download

memory/2684-129-0x00000000051F0000-0x0000000005208000-memory.dmp

Download

memory/2684-130-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download