agenttesla | 313cfc168cdc0f9f7a01a8ee6afbb8e67ba9b89a672ca4ebe5d754e0545dca28

Analysis

max time kernel
150s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SHIPMENT DOC.exe
Size 984KB
Sample221201-ta4zfade69
SHA256 313cfc168cdc0f9f7a01a8ee6afbb8e67ba9b89a672ca4ebe5d754e0545dca28
MD5 3ab9a1cb386fedec6a8039edc7b5990f
SHA1 46818d905c75d2bac0ac7b06fd6ef72b5b6adad5
SHA512 ddc3788539da3eb244a759bd3262f422c1cc50bfbcc49cb15cbbcedee3f338a9fc662ef8ba3ea5c4a5fa81a1f4aaf839750398b0078c57836451755928e7d7c7
SSDEEP 12288:8JsQjL9QzX7BIBi8pV4VpQWsNTAvsEOgAtzsWWN5WJeGciCK5XqEgHrc1NfpHsVe:mpjJQ5B8pnzT8sEasxj9KJkLcO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
bG^VamX7@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1472 set thread context of 944	1472	SHIPMENT DOC.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1472	SHIPMENT DOC.exe
944	SHIPMENT DOC.exe
944	SHIPMENT DOC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	SHIPMENT DOC.exe
Token: SeDebugPrivilege	944	SHIPMENT DOC.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 2040	1472	SHIPMENT DOC.exe	27
PID 1472 wrote to memory of 2040	1472	SHIPMENT DOC.exe	27
PID 1472 wrote to memory of 2040	1472	SHIPMENT DOC.exe	27
PID 1472 wrote to memory of 2040	1472	SHIPMENT DOC.exe	27
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28
PID 1472 wrote to memory of 944	1472	SHIPMENT DOC.exe	28

C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOC.exe
"C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOC.exe
  "{path}"
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOC.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/944-64-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/944-59-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/944-60-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/944-63-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/944-62-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/944-67-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/944-69-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1472-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

Download

memory/1472-56-0x0000000000590000-0x00000000005A2000-memory.dmp

Download

memory/1472-57-0x0000000005160000-0x00000000051E4000-memory.dmp

Download

memory/1472-58-0x0000000004C40000-0x0000000004C7C000-memory.dmp

Download

memory/1472-54-0x00000000001D0000-0x00000000002CC000-memory.dmp

Download