agenttesla | 64613e9558bf51f7c56f7e3f7a7d770e87859e8a8bac31a67c6dab53c59d53d5

Analysis

max time kernel
152s
max time network
148s
platform
windows7_x64
resource
win7-en-20211208
submitted
08/02/2022, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO #30114.exe
Size 121KB
Sample220208-kep7eaehal
SHA256 64613e9558bf51f7c56f7e3f7a7d770e87859e8a8bac31a67c6dab53c59d53d5
MD5 294b7c06479a50f7d4b187299d159747
SHA1 cbb621c5a8d2cf07901105835d4cab34a5cdef3f
SHA512 34c2ae855dab03467e309ed6f4623ee53ba8e8468b45b85240ec2f3c3f4a80e258f6fcb7addcb44d92ee80dbce42f8b1c92f18e4e4342897eb321982fa588798
MD5 SHA1 SHA512

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.bhgautopartes.com
Port
587
Username
[email protected]
Password
icui4cu2@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1076-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1076-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1076-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1076-67-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 1076	1984	PO #30114.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1984	PO #30114.exe
1076	MSBuild.exe
1076	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	PO #30114.exe
Token: SeDebugPrivilege	1076	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29
PID 1984 wrote to memory of 1076	1984	PO #30114.exe	29

C:\Users\Admin\AppData\Local\Temp\PO #30114.exe
"C:\Users\Admin\AppData\Local\Temp\PO #30114.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-63-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1076-69-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/1076-68-0x0000000074010000-0x00000000746FE000-memory.dmp

Download

memory/1076-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1076-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1076-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1076-64-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1076-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1984-58-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/1984-61-0x0000000004890000-0x00000000048DC000-memory.dmp

Download

memory/1984-60-0x0000000001180000-0x00000000011C2000-memory.dmp

Download

memory/1984-59-0x0000000000C90000-0x0000000000CE2000-memory.dmp

Download

memory/1984-55-0x0000000074020000-0x000000007470E000-memory.dmp

Download

memory/1984-57-0x0000000074B21000-0x0000000074B23000-memory.dmp

Download

memory/1984-56-0x0000000001380000-0x00000000013A4000-memory.dmp

Download