agenttesla | eeff87f3b345b9b42f721cfdd82fa81e229c7599ef4a24d3af914e2740a7a44c

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
21-11-2023 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

231121-11-AgentTesla-fe5abc.exe
Size

1.3MB
MD5

233f382c6f7e034b6588fdd07dae612e
SHA1

fe5abc8495a6bd9643bdabd9463a6d1800fd9f39
SHA256

ed414c5cd76f7735a701b3c734bc8b7fc0d21e2143eae7925e57451d49b256ea
SHA512

c769410f24d1ca59e3342190ad0d6468f6b6f006892b42d633998674821910ad09e5161e0b466d0f201406ed19ceb84d1a1d57661c9a4796183146b3e0d6f231
SSDEEP

12288:+FJyQvvYEoIkcGUdLJWsYdt41FoMUcj/0jFSbvcv2Y2XxRkz9BhnVH:+FJyjEoI/GUFJKdt41hLBc2x2JBhn

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
28#75@ts76&&p!!@@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

231121-11-AgentTesla-fe5abc.exe

description pid process target process

PID 1356 set thread context of 2992 1356 231121-11-AgentTesla-fe5abc.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

aspnet_compiler.exe

pid process

2992 aspnet_compiler.exe
2992 aspnet_compiler.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

aspnet_compiler.exe

description pid process

Token: SeDebugPrivilege 2992 aspnet_compiler.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid process

2992 aspnet_compiler.exe

description	pid	process	target process
PID 1356 set thread context of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe

pid	process
2992	aspnet_compiler.exe
2992	aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	2992	aspnet_compiler.exe

pid	process
2992	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

231121-11-AgentTesla-fe5abc.exe

description	pid	process	target process
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe
PID 1356 wrote to memory of 2992	1356	231121-11-AgentTesla-fe5abc.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\231121-11-AgentTesla-fe5abc.exe
"C:\Users\Admin\AppData\Local\Temp\231121-11-AgentTesla-fe5abc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1356-21-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/1356-4-0x0000000000800000-0x0000000000840000-memory.dmp

Filesize
256KB

Download
memory/1356-0-0x00000000002F0000-0x0000000000442000-memory.dmp

Filesize
1.3MB

Download
memory/1356-3-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/1356-1-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/1356-5-0x00000000008D0000-0x0000000000910000-memory.dmp

Filesize
256KB

Download
memory/1356-6-0x0000000004240000-0x000000000428C000-memory.dmp

Filesize
304KB

Download
memory/1356-7-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/1356-8-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/1356-2-0x00000000007A0000-0x00000000007F8000-memory.dmp

Filesize
352KB

Download
memory/2992-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-22-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2992-25-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2992-26-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/2992-27-0x0000000004C20000-0x0000000004C60000-memory.dmp

Filesize
256KB

Download