agenttesla | 01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
Size 671KB
Sample230802-j3valade88
SHA256 01af6a15beb6d627c8e7d255eb0d8f2e1167d710b101973b8da9b50246368bf3
MD5 bd6687dd7ec1ee893b0394316ec2249b
SHA1 a73fd83405530c5905cd675eacf00213250c2477
SHA512 8918ab4cc4089dce89984e14354aaf849450ce497e0b96a43cdbd56dcbd34f4056f60b5c5640ccb310dcac5f24ec0fa6eaf392af2332f411c8301858dc0bb073
SSDEEP 12288:d5MYO0M22fUQbYNrxUtduItO/bqvw7yZiA3mdBLFGrfeY:d6DCwU6YNFUSItYbqvwyKDFt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
us2.smtp.mailhostbox.com
Port
587
Username
[email protected]
Password
JUGCRsm9
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
Token: SeDebugPrivilege	2732	RegSvcs.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2932	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	30
PID 2912 wrote to memory of 2932	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	30
PID 2912 wrote to memory of 2932	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	30
PID 2912 wrote to memory of 2932	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	30
PID 2912 wrote to memory of 2932	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	30
PID 2912 wrote to memory of 2932	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	30
PID 2912 wrote to memory of 2932	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	30
PID 2912 wrote to memory of 2860	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	31
PID 2912 wrote to memory of 2860	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	31
PID 2912 wrote to memory of 2860	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	31
PID 2912 wrote to memory of 2860	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	31
PID 2912 wrote to memory of 2860	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	31
PID 2912 wrote to memory of 2860	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	31
PID 2912 wrote to memory of 2860	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	31
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32
PID 2912 wrote to memory of 2732	2912	57m³ LPG SEMI TRAILER 7 NOS.pdf.exe	32

C:\Users\Admin\AppData\Local\Temp\57m³ LPG SEMI TRAILER 7 NOS.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\57m³ LPG SEMI TRAILER 7 NOS.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2732-66-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2732-75-0x0000000001110000-0x0000000001150000-memory.dmp

Download

memory/2732-74-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/2732-73-0x0000000001110000-0x0000000001150000-memory.dmp

Download

memory/2732-72-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/2732-70-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2732-68-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2732-60-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2732-61-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2732-62-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2732-63-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2732-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2912-58-0x00000000004A0000-0x00000000004AA000-memory.dmp

Download

memory/2912-59-0x0000000004F90000-0x0000000004FFA000-memory.dmp

Download

memory/2912-53-0x00000000002D0000-0x000000000037E000-memory.dmp

Download

memory/2912-71-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/2912-57-0x0000000073F80000-0x000000007466E000-memory.dmp

Download

memory/2912-56-0x0000000000480000-0x0000000000490000-memory.dmp

Download

memory/2912-55-0x0000000004900000-0x0000000004940000-memory.dmp

Download

memory/2912-54-0x0000000073F80000-0x000000007466E000-memory.dmp

Download