agenttesla | e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe
Size

1.2MB
MD5

944a0048e334fd1cf24f880bf0d17702
SHA1

9f5f69ba1f5c449e073a83fa0d40ea79b23cb839
SHA256

e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a
SHA512

3f6bbbefad01b129c3844ad0d83ce56198e2c31c3167b4baad0a2c35e2ad2beeec03d49c7cac54ba9dd56b9993994e7b98b028bac997b77c98e7f6044999fa32
SSDEEP

12288:RQA22qBJWPLprpPglhopSu/6jkq/91XvWeonUAvLkr:yd1UthuWp5cl1Zee0UAvLU

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.tekserendustriyel.com
Port:
21
Username:
[email protected]
Password:
chuzy2024@

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
2 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe

description pid process target process

PID 2072 set thread context of 3008 2072 e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe CasPol.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CasPol.exe

pid process

3008 CasPol.exe
3008 CasPol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CasPol.exe

description pid process

Token: SeDebugPrivilege 3008 CasPol.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CasPol.exe

pid process

3008 CasPol.exe

flow	ioc
3	api.ipify.org
2	api.ipify.org

description	pid	process	target process
PID 2072 set thread context of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe

pid	process
3008	CasPol.exe
3008	CasPol.exe

description	pid	process
Token: SeDebugPrivilege	3008	CasPol.exe

pid	process
3008	CasPol.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe

description	pid	process	target process
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 3008	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	CasPol.exe
PID 2072 wrote to memory of 2732	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	WerFault.exe
PID 2072 wrote to memory of 2732	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	WerFault.exe
PID 2072 wrote to memory of 2732	2072	e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe
"C:\Users\Admin\AppData\Local\Temp\e3ffaae53b7127d22d6ca2fd83b126136437c63d422127cd309963e0c6f8e71a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3008

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2072 -s 628
2⤵
PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2072-0-0x000007FEF59C3000-0x000007FEF59C4000-memory.dmp

Filesize
4KB

Download
memory/2072-1-0x0000000000E20000-0x0000000000E28000-memory.dmp

Filesize
32KB

Download
memory/2072-2-0x0000000000550000-0x00000000005E4000-memory.dmp

Filesize
592KB

Download
memory/2072-3-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

Filesize
9.9MB

Download
memory/2072-21-0x000007FEF59C0000-0x000007FEF63AC000-memory.dmp

Filesize
9.9MB

Download
memory/2072-20-0x000007FEF59C3000-0x000007FEF59C4000-memory.dmp

Filesize
4KB

Download
memory/3008-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-18-0x00000000742DE000-0x00000000742DF000-memory.dmp

Filesize
4KB

Download
memory/3008-19-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/3008-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3008-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3008-22-0x00000000742DE000-0x00000000742DF000-memory.dmp

Filesize
4KB

Download
memory/3008-23-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download