agenttesla | a4bb03a910b76efa7a34c7eb0554be36011abadbf0ec37055de74b0e7879582e

Analysis

max time kernel
48s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ba78cc61dcd5a846639762fb954d1de.exe
Size

1.3MB
MD5

1ba78cc61dcd5a846639762fb954d1de
SHA1

80eb96d449d0e676c6bb608b7787834e80ca84e4
SHA256

a4bb03a910b76efa7a34c7eb0554be36011abadbf0ec37055de74b0e7879582e
SHA512

475c4237fa19f57e301e5e1a7487a201238952aca4d764d837979effb84071e968c6e119b180712a65144e88fff48a7702ccc6ed1bc015e887ae2a6ce0e77f70
SSDEEP

24576:SWS/d32KzksSks2y8jA9aJu65iyxQogKVBtMN6ZNmZ:vKrQ9VZo7JIN6ZNm

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.barigarabia.com
Port:
587
Username:
[email protected]
Password:
ZdexWDrMLSb=

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/3152-12-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/1884-7-0x0000000005750000-0x0000000005762000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1884 set thread context of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3152	1ba78cc61dcd5a846639762fb954d1de.exe
3152	1ba78cc61dcd5a846639762fb954d1de.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	1ba78cc61dcd5a846639762fb954d1de.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102
PID 1884 wrote to memory of 3152	1884	1ba78cc61dcd5a846639762fb954d1de.exe	102

C:\Users\Admin\AppData\Local\Temp\1ba78cc61dcd5a846639762fb954d1de.exe
"C:\Users\Admin\AppData\Local\Temp\1ba78cc61dcd5a846639762fb954d1de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\1ba78cc61dcd5a846639762fb954d1de.exe
  "C:\Users\Admin\AppData\Local\Temp\1ba78cc61dcd5a846639762fb954d1de.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1ba78cc61dcd5a846639762fb954d1de.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/1884-6-0x00000000057A0000-0x000000000583C000-memory.dmp

Filesize
624KB

Download
memory/1884-16-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/1884-4-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/1884-5-0x00000000056F0000-0x00000000056FA000-memory.dmp

Filesize
40KB

Download
memory/1884-1-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/1884-0-0x00000000009F0000-0x0000000000B38000-memory.dmp

Filesize
1.3MB

Download
memory/1884-7-0x0000000005750000-0x0000000005762000-memory.dmp

Filesize
72KB

Download
memory/1884-8-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/1884-9-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/1884-11-0x00000000089B0000-0x00000000089EC000-memory.dmp

Filesize
240KB

Download
memory/1884-3-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/1884-2-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/1884-10-0x0000000006550000-0x00000000065EE000-memory.dmp

Filesize
632KB

Download
memory/3152-15-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/3152-12-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3152-17-0x0000000005110000-0x0000000005120000-memory.dmp

Filesize
64KB

Download
memory/3152-19-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Filesize
408KB

Download
memory/3152-18-0x0000000005550000-0x0000000005568000-memory.dmp

Filesize
96KB

Download
memory/3152-21-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/3152-22-0x0000000005110000-0x0000000005120000-memory.dmp

Filesize
64KB

Download
memory/3152-23-0x0000000006370000-0x00000000063C0000-memory.dmp

Filesize
320KB

Download
memory/3152-24-0x0000000005110000-0x0000000005120000-memory.dmp

Filesize
64KB

Download