agenttesla | 31973278e42bbfbffe3cd85a38276c4c4a6870c56828e45c5a828fe575c08775

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24-11-2023 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER LIST_NOVQTRFA00541·PDF.scr
Size

1.6MB
MD5

74e08a10e8e9adce66942aedf70907b4
SHA1

7734415270ab9d9c4d406ea953b3f88ed8daae2a
SHA256

d38f8cf2b6bb9ef5b9bafdc0a999d0c59c58eebad06bdd252fd2007e9701fe76
SHA512

0bcc851a677932773ca6922cee9836152e264461bd12979b05a2692566100fd4a883622b26671469a1b27bf1912b69fc12bafc53fa8fbcf44bbe7f69941df9aa
SSDEEP

49152:CQCsQ2u2UOGOgfagvVI+ze63xnZFCuT3T:Cm+zVh3Tj

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
sgohuypjasozryng
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2760	aspnet_compiler.exe
2760	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2760	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30
PID 2136 wrote to memory of 2760	2136	ORDER LIST_NOVQTRFA00541·PDF.scr	30

C:\Users\Admin\AppData\Local\Temp\ORDER LIST_NOVQTRFA00541·PDF.scr
"C:\Users\Admin\AppData\Local\Temp\ORDER LIST_NOVQTRFA00541·PDF.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-18-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-4-0x0000000000200000-0x0000000000240000-memory.dmp

Filesize
256KB

Download
memory/2136-0-0x0000000000870000-0x0000000000A1A000-memory.dmp

Filesize
1.7MB

Download
memory/2136-3-0x0000000000AB0000-0x0000000000AF0000-memory.dmp

Filesize
256KB

Download
memory/2136-1-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-5-0x0000000000700000-0x0000000000740000-memory.dmp

Filesize
256KB

Download
memory/2136-6-0x0000000000800000-0x000000000084C000-memory.dmp

Filesize
304KB

Download
memory/2136-7-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2136-8-0x0000000000AB0000-0x0000000000AF0000-memory.dmp

Filesize
256KB

Download
memory/2136-2-0x0000000000580000-0x00000000005D8000-memory.dmp

Filesize
352KB

Download
memory/2760-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2760-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2760-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2760-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2760-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2760-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2760-19-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2760-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2760-22-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download
memory/2760-23-0x0000000000370000-0x00000000003B0000-memory.dmp

Filesize
256KB

Download
memory/2760-24-0x0000000074240000-0x000000007492E000-memory.dmp

Filesize
6.9MB

Download