agenttesla | 289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383

Analysis

max time kernel
77s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe
Size

2.3MB
MD5

0836be75ada3e2f608f9a275d45c996f
SHA1

10d9e8ec87f51bc9553c5d7a6c5a7926cae0851f
SHA256

289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383
SHA512

439cd2a9758e4db6f6bb3cc40dadcb24b50ebfccc149cae1293e67bf1e5c6cd9291485c3f7f7dccb8f6dd697c117699a561be6e64d4e694115f766a0c8346af3
SSDEEP

49152:eF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPUteaw1GWNOmefX:croA7PWioX

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot6766067146:AAHFJ0MibSkcw884er6PWmsW8KsHwF4xGxc/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe

description pid process target process

PID 956 set thread context of 3844 956 289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe aspnet_wp.exe
Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

4168 regedit.exe

description	pid	process	target process
PID 956 set thread context of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe

pid	process
4168	regedit.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exeaspnet_wp.exe

description	pid	process	target process
PID 956 wrote to memory of 2140	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	notepad.exe
PID 956 wrote to memory of 2140	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	notepad.exe
PID 956 wrote to memory of 2140	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	notepad.exe
PID 956 wrote to memory of 2140	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	notepad.exe
PID 956 wrote to memory of 2140	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	notepad.exe
PID 956 wrote to memory of 2140	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	notepad.exe
PID 956 wrote to memory of 3808	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	vbc.exe
PID 956 wrote to memory of 3808	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	vbc.exe
PID 956 wrote to memory of 3808	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	vbc.exe
PID 956 wrote to memory of 3808	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	vbc.exe
PID 956 wrote to memory of 4168	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	regedit.exe
PID 956 wrote to memory of 4168	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	regedit.exe
PID 956 wrote to memory of 4168	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	regedit.exe
PID 956 wrote to memory of 4168	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	regedit.exe
PID 956 wrote to memory of 4168	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	regedit.exe
PID 956 wrote to memory of 4168	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	regedit.exe
PID 956 wrote to memory of 4968	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	cmd.exe
PID 956 wrote to memory of 4968	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	cmd.exe
PID 956 wrote to memory of 4968	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	cmd.exe
PID 956 wrote to memory of 4968	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	cmd.exe
PID 956 wrote to memory of 4968	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	cmd.exe
PID 956 wrote to memory of 4968	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	cmd.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 956 wrote to memory of 3844	956	289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe	aspnet_wp.exe
PID 3844 wrote to memory of 3320	3844	aspnet_wp.exe	msedge.exe
PID 3844 wrote to memory of 3320	3844	aspnet_wp.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe
"C:\Users\Admin\AppData\Local\Temp\289b62f2e1ec19c7f622b48703c1105fd3b5c03f6d25a4447b19f061dc3bc383.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe"
2⤵
PID:2140

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:3808

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
2⤵
- Runs regedit.exe
PID:4168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:4968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_wp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_wp.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4744 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4732 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=748 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4780 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5572 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=3868 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=5624 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6112 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=748 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6288 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3844-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download