agenttesla | 71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2

Analysis

max time kernel
125s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 01:12

Target

71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe
Size

1.9MB
MD5

85a68d401bbb5751b02fb9ca159b6eff
SHA1

99b6b9e728ebc315a2ae04505de04b0f922f7cd1
SHA256

71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2
SHA512

0f83dc75c47794dcaea3e8ec00f472e2b9281ece33031c9894671522f25489a446bc9c1ecc980a8ca262a7cb6cb5c3d43d22cf692a2094ec01410bca44b718df
SSDEEP

49152:bOD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5Z/IrRo2ht1a1nvkJzJ:Sv85QzJ

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
16 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe

description pid process target process

PID 3752 set thread context of 3240 3752 71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe jsc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

704 3240 WerFault.exe jsc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jsc.exe

pid process

3240 jsc.exe
3240 jsc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

jsc.exe

description pid process

Token: SeDebugPrivilege 3240 jsc.exe

flow	ioc
15	api.ipify.org
16	api.ipify.org

description	pid	process	target process
PID 3752 set thread context of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe

pid	pid_target	process	target process
704	3240	WerFault.exe	jsc.exe

pid	process
3240	jsc.exe
3240	jsc.exe

description	pid	process
Token: SeDebugPrivilege	3240	jsc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe

description	pid	process	target process
PID 3752 wrote to memory of 1580	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	AddInProcess32.exe
PID 3752 wrote to memory of 1580	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	AddInProcess32.exe
PID 3752 wrote to memory of 1580	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	AddInProcess32.exe
PID 3752 wrote to memory of 1580	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	AddInProcess32.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe
PID 3752 wrote to memory of 3240	3752	71cb5530f635f1229d43e4fe9c5bbdb04cf9053832fa006750690854a883eff2.exe	jsc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 2016
3⤵
- Program crash
PID:704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 3240
1⤵
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4040,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:8
1⤵
PID:2864

memory/3240-1-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3240-2-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

Filesize
4KB

Download
memory/3240-3-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/3240-4-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/3240-5-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3240-6-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download