agenttesla | f936f3df58fe783f2b89a3e836e77727399c86fce62541e46ece8ad3039645b8

Analysis

max time kernel
51s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

comprobante.pdf.exe
Size

1.1MB
MD5

36caa90ad7983f4d019e45ffe4563f96
SHA1

375af942d0e826b9bdd8213284790f3f88695f6e
SHA256

460466b4bd3a9389f45e255c2dc48bc49f59cea7ed45f10f1b052442bb8e8175
SHA512

ffd0924b4eebb237f25a7421f7f33176a96d51371b710e169255553691efda93648b535b68d273fe83a43364b33d575bc3af789de0db6aa80d72ebe4d6f1febc
SSDEEP

12288:cne8ES7hCJH213UvLYu6fMxnbsEBEXPCtnJUcVpt34gv0ZGmgkddP63FRPRVmn:IEzJ64k9ExbsEBE6tJUcVpt34I01gkd

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
serv-10708.handsonwebhosting.com
Port:
587
Username:
[email protected]
Password:
icui4cu2@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/760-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3016 set thread context of 760	3016	comprobante.pdf.exe	101

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
760	comprobante.pdf.exe
760	comprobante.pdf.exe
760	comprobante.pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	comprobante.pdf.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101
PID 3016 wrote to memory of 760	3016	comprobante.pdf.exe	101

C:\Users\Admin\AppData\Local\Temp\comprobante.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\comprobante.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\comprobante.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\comprobante.pdf.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/760-25-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/760-24-0x00000000066F0000-0x0000000006740000-memory.dmp

Filesize
320KB

Download
memory/760-22-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/760-21-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/760-19-0x00000000060D0000-0x00000000060E8000-memory.dmp

Filesize
96KB

Download
memory/760-20-0x0000000006170000-0x00000000061D6000-memory.dmp

Filesize
408KB

Download
memory/760-17-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/760-16-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/3016-10-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3016-0-0x00000000009B0000-0x0000000000AC6000-memory.dmp

Filesize
1.1MB

Download
memory/3016-11-0x0000000004DD0000-0x0000000004E66000-memory.dmp

Filesize
600KB

Download
memory/3016-12-0x000000000A260000-0x000000000A29C000-memory.dmp

Filesize
240KB

Download
memory/3016-9-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/3016-8-0x00000000057B0000-0x00000000057CE000-memory.dmp

Filesize
120KB

Download
memory/3016-18-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/3016-2-0x00000000053E0000-0x000000000547C000-memory.dmp

Filesize
624KB

Download
memory/3016-1-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/3016-6-0x0000000005390000-0x000000000539A000-memory.dmp

Filesize
40KB

Download
memory/3016-7-0x00000000056C0000-0x0000000005716000-memory.dmp

Filesize
344KB

Download
memory/3016-5-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3016-4-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/3016-3-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Filesize
5.6MB

Download