agenttesla | e1f8835fc23a0b11513cac6750fd594fb853edcab74db71faedaeed3431f6ef8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 01:54

Target

ss.exe
Size

1.0MB
MD5

6c10bc159358093f6e827b170bcddeda
SHA1

1e9109ffb469e5c1fa2535c74f50c6afb7f99d66
SHA256

664c0c690a791c1a863702884b3b3bd0aead7fabbd3ff6e46cff58f53c1cd3ff
SHA512

d2f781e2152b341e086573007cd06b18142be352a8470749526ec6c50da615989eef6c1313ff10b01d5f46a7c5691377f81cbd5d91ae0361f3a7a010c3c71b4d
SSDEEP

24576:kAHnh+eWsN3skA4RV1Hom2KXMmHaswyH8aNpmq5:zh+ZkldoPK8YasbNz

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

ss.exe

description pid process target process

PID 4200 set thread context of 3444 4200 ss.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

3444 RegSvcs.exe
3444 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ss.exe

pid process

4200 ss.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3444 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

ss.exe

pid process

4200 ss.exe
4200 ss.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

ss.exe

pid process

4200 ss.exe
4200 ss.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

3444 RegSvcs.exe

description	pid	process	target process
PID 4200 set thread context of 3444	4200	ss.exe	RegSvcs.exe

pid	process
3444	RegSvcs.exe
3444	RegSvcs.exe

pid	process
4200	ss.exe

description	pid	process
Token: SeDebugPrivilege	3444	RegSvcs.exe

pid	process
4200	ss.exe
4200	ss.exe

pid	process
4200	ss.exe
4200	ss.exe

pid	process
3444	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ss.exe

description	pid	process	target process
PID 4200 wrote to memory of 3444	4200	ss.exe	RegSvcs.exe
PID 4200 wrote to memory of 3444	4200	ss.exe	RegSvcs.exe
PID 4200 wrote to memory of 3444	4200	ss.exe	RegSvcs.exe
PID 4200 wrote to memory of 3444	4200	ss.exe	RegSvcs.exe

memory/3444-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3444-12-0x000000007527E000-0x000000007527F000-memory.dmp

Filesize
4KB

Download
memory/3444-13-0x0000000005FF0000-0x0000000006594000-memory.dmp

Filesize
5.6MB

Download
memory/3444-14-0x0000000005AB0000-0x0000000005B16000-memory.dmp

Filesize
408KB

Download
memory/3444-15-0x0000000075270000-0x0000000075A20000-memory.dmp

Filesize
7.7MB

Download
memory/3444-16-0x00000000069F0000-0x0000000006A40000-memory.dmp

Filesize
320KB

Download
memory/3444-17-0x0000000006AE0000-0x0000000006B72000-memory.dmp

Filesize
584KB

Download
memory/3444-18-0x0000000006AD0000-0x0000000006ADA000-memory.dmp

Filesize
40KB

Download
memory/3444-19-0x000000007527E000-0x000000007527F000-memory.dmp

Filesize
4KB

Download
memory/3444-20-0x0000000075270000-0x0000000075A20000-memory.dmp

Filesize
7.7MB

Download
memory/4200-10-0x0000000001F30000-0x0000000001F34000-memory.dmp

Filesize
16KB

Download