agenttesla | fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:00

Target

fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe
Size

223KB
MD5

4a49a8abf60ecb81fc23e6d1ed35a42e
SHA1

d6836688b3806af42f3ee1dc88b9479c84fed49b
SHA256

fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b
SHA512

988d6cb2045301523a923fc0e58c63d3e522fd59b1631c422cd48acadafd024069eb237f0ebb180a075897142a1ce3f81eb8816953c00e11f72260d0b111a591
SSDEEP

3072:/oTa9jqHiBVyfqpl656wNLamMcnDAxRCzSpCTVtRGFuSSMWfYjTc:/oTaB7BV2cl6nWmtQp0TVlSc

Score

10^/10

Credentials

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe

description pid process target process

PID 4668 set thread context of 1324 4668 fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe cvtres.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.execvtres.exe

pid process

4668 fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe
4668 fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe
1324 cvtres.exe
1324 cvtres.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.execvtres.exe

description pid process

Token: SeDebugPrivilege 4668 fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe
Token: SeDebugPrivilege 1324 cvtres.exe

flow	ioc
17	ip-api.com

description	pid	process	target process
PID 4668 set thread context of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe

description	pid	process
Token: SeDebugPrivilege	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe
Token: SeDebugPrivilege	1324	cvtres.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe

description	pid	process	target process
PID 4668 wrote to memory of 940	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 940	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 940	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe
PID 4668 wrote to memory of 1324	4668	fc19a2a39649706f91b565b3514a0a908551b7702c6a99423972c526a3d9eb4b.exe	cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
2⤵
PID:940

memory/1324-10-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download
memory/1324-11-0x00000000069E0000-0x0000000006A30000-memory.dmp

Filesize
320KB

Download
memory/1324-16-0x0000000074C60000-0x0000000075410000-memory.dmp

Filesize
7.7MB

Download
memory/1324-15-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/1324-14-0x0000000006B90000-0x0000000006B9A000-memory.dmp

Filesize
40KB

Download
memory/1324-13-0x0000000006C10000-0x0000000006CA2000-memory.dmp

Filesize
584KB

Download
memory/1324-12-0x0000000006AD0000-0x0000000006B6C000-memory.dmp

Filesize
624KB

Download
memory/1324-6-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/1324-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1324-9-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/1324-8-0x0000000005B10000-0x00000000060B4000-memory.dmp

Filesize
5.6MB

Download
memory/4668-0-0x00007FFE97363000-0x00007FFE97365000-memory.dmp

Filesize
8KB

Download
memory/4668-7-0x00007FFE97360000-0x00007FFE97E21000-memory.dmp

Filesize
10.8MB

Download
memory/4668-1-0x0000000000C50000-0x0000000000C8C000-memory.dmp

Filesize
240KB

Download
memory/4668-3-0x0000000003000000-0x000000000300A000-memory.dmp

Filesize
40KB

Download
memory/4668-2-0x00007FFE97360000-0x00007FFE97E21000-memory.dmp

Filesize
10.8MB

Download