agenttesla | fa8025405c4c0290b63c2bbdf413edf496b729abe7bc791eb125f2c21895c842

Analysis

max time kernel
55s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d6c5824ba1d09d610cf914f003c7276.exe
Size

1.1MB
MD5

2d6c5824ba1d09d610cf914f003c7276
SHA1

3c3155f0f1dd4aa1a6848892cc75399da642662a
SHA256

fa8025405c4c0290b63c2bbdf413edf496b729abe7bc791eb125f2c21895c842
SHA512

e1fc9a2d3ae761c80b5dbe55e8337d507ab966d57eb6fe7def21cbf7f913a26c358a3f4308da8abe10b11ae981b6f4744a4031866eca5b82d7f93ae09706492a
SSDEEP

24576:ZrOXgPVt25/d3F4JaKu4YkueiPUFPBBInmkaK14shf1:ZrOw7W4JaKpYkufUFPBBIfSsl1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
uscentral50.myserverhosts.com
Port:
587
Username:
[email protected]
Password:
waters@789

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/1908-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/4060-8-0x0000000005010000-0x0000000005022000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4060 set thread context of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4060	2d6c5824ba1d09d610cf914f003c7276.exe
4060	2d6c5824ba1d09d610cf914f003c7276.exe
1908	RegSvcs.exe
1908	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	2d6c5824ba1d09d610cf914f003c7276.exe
Token: SeDebugPrivilege	1908	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102
PID 4060 wrote to memory of 1908	4060	2d6c5824ba1d09d610cf914f003c7276.exe	102

C:\Users\Admin\AppData\Local\Temp\2d6c5824ba1d09d610cf914f003c7276.exe
"C:\Users\Admin\AppData\Local\Temp\2d6c5824ba1d09d610cf914f003c7276.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1908-25-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/1908-24-0x0000000002B90000-0x0000000002BE0000-memory.dmp

Filesize
320KB

Download
memory/1908-22-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/1908-21-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/1908-18-0x0000000005650000-0x0000000005668000-memory.dmp

Filesize
96KB

Download
memory/1908-19-0x00000000063D0000-0x0000000006436000-memory.dmp

Filesize
408KB

Download
memory/1908-15-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/1908-17-0x0000000005430000-0x0000000005440000-memory.dmp

Filesize
64KB

Download
memory/4060-5-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/4060-11-0x00000000065F0000-0x0000000006672000-memory.dmp

Filesize
520KB

Download
memory/4060-12-0x00000000066A0000-0x00000000066DE000-memory.dmp

Filesize
248KB

Download
memory/4060-9-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4060-16-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4060-8-0x0000000005010000-0x0000000005022000-memory.dmp

Filesize
72KB

Download
memory/4060-6-0x0000000004CA0000-0x0000000004CAA000-memory.dmp

Filesize
40KB

Download
memory/4060-10-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/4060-7-0x0000000004F90000-0x0000000004FE6000-memory.dmp

Filesize
344KB

Download
memory/4060-2-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4060-4-0x0000000004E00000-0x0000000004E92000-memory.dmp

Filesize
584KB

Download
memory/4060-0-0x0000000000190000-0x00000000002AC000-memory.dmp

Filesize
1.1MB

Download
memory/4060-1-0x0000000004CD0000-0x0000000004D6C000-memory.dmp

Filesize
624KB

Download
memory/4060-3-0x00000000053B0000-0x0000000005954000-memory.dmp

Filesize
5.6MB

Download