agenttesla | 4f3c0de5a08e918050382a42c6109fda68cc8167664065ebd98c73d761fde3f3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
Size

1.2MB
MD5

bf62b57ee6b1e88d479e982fcc5bcf68
SHA1

35956b67857e333893689bf293b053653180bc87
SHA256

174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8
SHA512

ce25b0d13a2af6df4a89a7376684535b78b2cf4fff76121344ab700a70852f0a23f70eddbe8884f70584c4a12afbc20149a4e6253a23de5294672d0998713553
SSDEEP

24576:PAHnh+eWsN3skA4RV1Hom2KXMmHa0cBsAbHXBRSPO2fC5:yh+ZkldoPK8Ya0ahdRFP

Score

10^/10

agenttesla keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

description pid process target process

PID 2436 set thread context of 1976 2436 174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1976 RegSvcs.exe
1976 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

pid process

2436 174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1976 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

pid process

2436 174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
2436 174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

pid process

2436 174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
2436 174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

description	pid	process	target process
PID 2436 set thread context of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe

pid	process
1976	RegSvcs.exe
1976	RegSvcs.exe

pid	process
2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

description	pid	process
Token: SeDebugPrivilege	1976	RegSvcs.exe

pid	process
2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

pid	process
2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe

description	pid	process	target process
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe
PID 2436 wrote to memory of 1976	2436	174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe
"C:\Users\Admin\AppData\Local\Temp\174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\174d337dc96f1d28833631db40dfb53ed28878b50ade6698a423b222b3ff78e8.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Clinton
Filesize
262KB

MD5
025b512e55f6046c8f7495866b98b5e3

SHA1
40f9882f515f86cf9d3b785024a4bcb348b66b93

SHA256
426650b0d9a3cd5a2a4ff284750b74abe70ed9d83a6be348512eea7e542f40e4

SHA512
a3f391a13d8c977079f8106e29260e6fc33f7ec46bd6ef3cff1c468fad17cf9db7e5e6427a9b4b745c2caefbb9163046b05c05bd04312d490742161d524a21e7

Download Submit
memory/1976-46-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-1059-0x000000007423E000-0x000000007423F000-memory.dmp

Filesize
4KB

Download
memory/1976-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1976-42-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-16-0x000000007423E000-0x000000007423F000-memory.dmp

Filesize
4KB

Download
memory/1976-17-0x0000000000AE0000-0x0000000000B34000-memory.dmp

Filesize
336KB

Download
memory/1976-18-0x0000000000BA0000-0x0000000000BF4000-memory.dmp

Filesize
336KB

Download
memory/1976-19-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1976-36-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-38-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-191-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1976-78-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-74-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-72-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-68-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-66-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-62-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-1056-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1976-56-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-54-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-48-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-1060-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1976-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1976-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1976-60-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-30-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-28-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-27-0x0000000074230000-0x000000007491E000-memory.dmp

Filesize
6.9MB

Download
memory/1976-25-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-23-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-21-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-20-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-80-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-76-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-70-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-64-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-58-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-52-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-50-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-44-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-40-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-32-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/1976-1058-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1976-34-0x0000000000BA0000-0x0000000000BED000-memory.dmp

Filesize
308KB

Download
memory/2436-11-0x0000000000130000-0x0000000000134000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads