agenttesla | d5de496be1535d0b8d9c8f57087e9ae2a26aaf7c33c2ddca65b3231dc3b2460b

Analysis

max time kernel
91s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SWIFT copy.29112022.Pdf.exe
Size 745KB
Sample221129-vypebsch5x
SHA256 d5de496be1535d0b8d9c8f57087e9ae2a26aaf7c33c2ddca65b3231dc3b2460b
MD5 5f400bae896422a69db460a4507fd657
SHA1 e90b7c431d34b39bef8492de7fb987f51c3fb804
SHA512 7e54192c570d2a7fe7700d69bd782173dfe41dc102afceffbda47207d4bfcb80783f7c70bf9666e287ccbcf413bf482aeb321fe559ba7b75ae43416b0feee643
SSDEEP 12288:ZYn2P8Ai1FDasqS6/0kz0z63eR7J/ZmhOQQVvedp:qn20t1Ffl+0kzAttq62
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.nutiribio.com
Port
587
Username
[email protected]
Password
zGNVO(l5

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 6 IoCs

resource	yara_rule
behavioral1/memory/1344-65-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1344-64-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1344-66-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1344-67-0x0000000000436C4E-mapping.dmp	family_agenttesla
behavioral1/memory/1344-71-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/1344-69-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 1344	1664	SWIFT copy.29112022.Pdf.exe	31

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1664	SWIFT copy.29112022.Pdf.exe
1664	SWIFT copy.29112022.Pdf.exe
1664	SWIFT copy.29112022.Pdf.exe
1344	SWIFT copy.29112022.Pdf.exe
1344	SWIFT copy.29112022.Pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	SWIFT copy.29112022.Pdf.exe
Token: SeDebugPrivilege	1344	SWIFT copy.29112022.Pdf.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1376	1664	SWIFT copy.29112022.Pdf.exe	28
PID 1664 wrote to memory of 1376	1664	SWIFT copy.29112022.Pdf.exe	28
PID 1664 wrote to memory of 1376	1664	SWIFT copy.29112022.Pdf.exe	28
PID 1664 wrote to memory of 1376	1664	SWIFT copy.29112022.Pdf.exe	28
PID 1664 wrote to memory of 1348	1664	SWIFT copy.29112022.Pdf.exe	29
PID 1664 wrote to memory of 1348	1664	SWIFT copy.29112022.Pdf.exe	29
PID 1664 wrote to memory of 1348	1664	SWIFT copy.29112022.Pdf.exe	29
PID 1664 wrote to memory of 1348	1664	SWIFT copy.29112022.Pdf.exe	29
PID 1664 wrote to memory of 1276	1664	SWIFT copy.29112022.Pdf.exe	30
PID 1664 wrote to memory of 1276	1664	SWIFT copy.29112022.Pdf.exe	30
PID 1664 wrote to memory of 1276	1664	SWIFT copy.29112022.Pdf.exe	30
PID 1664 wrote to memory of 1276	1664	SWIFT copy.29112022.Pdf.exe	30
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31
PID 1664 wrote to memory of 1344	1664	SWIFT copy.29112022.Pdf.exe	31

C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe"
  2⤵
  PID:1376
- C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe"
  2⤵
  PID:1348
- C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe"
  2⤵
  PID:1276
- C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SWIFT copy.29112022.Pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-69-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-71-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-66-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-64-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-65-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1344-61-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1664-57-0x00000000004B0000-0x00000000004C6000-memory.dmp

Download

memory/1664-60-0x0000000000EA0000-0x0000000000EDC000-memory.dmp

Download

memory/1664-59-0x0000000005780000-0x00000000057F6000-memory.dmp

Download

memory/1664-58-0x0000000000760000-0x000000000076E000-memory.dmp

Download

memory/1664-54-0x0000000000EE0000-0x0000000000FA0000-memory.dmp

Download

memory/1664-56-0x00000000048B0000-0x0000000004956000-memory.dmp

Download

memory/1664-55-0x0000000076181000-0x0000000076183000-memory.dmp

Download