agenttesla | 460466b4bd3a9389f45e255c2dc48bc49f59cea7ed45f10f1b052442bb8e8175

Analysis

max time kernel
162s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36caa90ad7983f4d019e45ffe4563f96.exe
Size

1.1MB
MD5

36caa90ad7983f4d019e45ffe4563f96
SHA1

375af942d0e826b9bdd8213284790f3f88695f6e
SHA256

460466b4bd3a9389f45e255c2dc48bc49f59cea7ed45f10f1b052442bb8e8175
SHA512

ffd0924b4eebb237f25a7421f7f33176a96d51371b710e169255553691efda93648b535b68d273fe83a43364b33d575bc3af789de0db6aa80d72ebe4d6f1febc
SSDEEP

12288:cne8ES7hCJH213UvLYu6fMxnbsEBEXPCtnJUcVpt34gv0ZGmgkddP63FRPRVmn:IEzJ64k9ExbsEBE6tJUcVpt34I01gkd

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
serv-10708.handsonwebhosting.com
Port:
587
Username:
[email protected]
Password:
icui4cu2@@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral2/memory/2920-13-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 812 set thread context of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	36caa90ad7983f4d019e45ffe4563f96.exe
2920	36caa90ad7983f4d019e45ffe4563f96.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	36caa90ad7983f4d019e45ffe4563f96.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112
PID 812 wrote to memory of 2920	812	36caa90ad7983f4d019e45ffe4563f96.exe	112

C:\Users\Admin\AppData\Local\Temp\36caa90ad7983f4d019e45ffe4563f96.exe
"C:\Users\Admin\AppData\Local\Temp\36caa90ad7983f4d019e45ffe4563f96.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\36caa90ad7983f4d019e45ffe4563f96.exe
  "C:\Users\Admin\AppData\Local\Temp\36caa90ad7983f4d019e45ffe4563f96.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-8-0x0000000005980000-0x00000000059D6000-memory.dmp

Filesize
344KB

Download
memory/812-4-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/812-0-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/812-3-0x0000000005A70000-0x0000000006014000-memory.dmp

Filesize
5.6MB

Download
memory/812-9-0x0000000006020000-0x000000000603E000-memory.dmp

Filesize
120KB

Download
memory/812-5-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/812-6-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/812-10-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/812-2-0x0000000005420000-0x00000000054BC000-memory.dmp

Filesize
624KB

Download
memory/812-1-0x00000000008E0000-0x00000000009F6000-memory.dmp

Filesize
1.1MB

Download
memory/812-7-0x00000000056B0000-0x00000000056BA000-memory.dmp

Filesize
40KB

Download
memory/812-11-0x0000000006A80000-0x0000000006B16000-memory.dmp

Filesize
600KB

Download
memory/812-12-0x0000000005A20000-0x0000000005A5C000-memory.dmp

Filesize
240KB

Download
memory/812-16-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/2920-15-0x00000000748F0000-0x00000000750A0000-memory.dmp

Filesize
7.7MB

Download
memory/2920-13-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2920-17-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download