agenttesla | b4a16aa8a75103a7740dc1cfaf67fa5accaee9e2e69b092e217e683befed16ff

Analysis

max time kernel
41s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XX(1).exe
Size

1.1MB
MD5

ceee05227b74e5a1e6d89f3b1cdfd24b
SHA1

7c7038b477f3d68226abf7eb1f8b4e9b9cfae331
SHA256

0f30bd5220de4c7fb2d426a392b5fcdbf1062b33a65761cb2af0d4732a2b2c2e
SHA512

931eed40bcb985de50c631f1b2565edf4bcdc78d56d9e2b31c608a634367c227325152dc4644d498924bcc09d5a11f3ace19193b9d1ea4aa897747f2b073a4c9
SSDEEP

24576:WAHnh+eWsN3skA4RV1Hom2KXMmHabDXVNuE25:xh+ZkldoPK8YabD3A

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

XX(1).exe

description pid process target process

PID 792 set thread context of 3812 792 XX(1).exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

3812 RegSvcs.exe
3812 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

XX(1).exe

pid process

792 XX(1).exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3812 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

XX(1).exe

pid process

792 XX(1).exe
792 XX(1).exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

XX(1).exe

pid process

792 XX(1).exe
792 XX(1).exe

flow	ioc
2	api.ipify.org

description	pid	process	target process
PID 792 set thread context of 3812	792	XX(1).exe	RegSvcs.exe

pid	process
3812	RegSvcs.exe
3812	RegSvcs.exe

pid	process
792	XX(1).exe

description	pid	process
Token: SeDebugPrivilege	3812	RegSvcs.exe

pid	process
792	XX(1).exe
792	XX(1).exe

pid	process
792	XX(1).exe
792	XX(1).exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

XX(1).exe

description	pid	process	target process
PID 792 wrote to memory of 3812	792	XX(1).exe	RegSvcs.exe
PID 792 wrote to memory of 3812	792	XX(1).exe	RegSvcs.exe
PID 792 wrote to memory of 3812	792	XX(1).exe	RegSvcs.exe
PID 792 wrote to memory of 3812	792	XX(1).exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\XX(1).exe
"C:\Users\Admin\AppData\Local\Temp\XX(1).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\XX(1).exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut4F87.tmp
Filesize
262KB

MD5
0627d8ea9c9a86c685642a0cada49435

SHA1
14b98255bfdb171dd4c4493dbf37a9599750aa06

SHA256
e79b150ec9f056e0debfaa6377c5b496e17a2afb00418bc417f9ad3706ff1787

SHA512
26ef50ccfaae562f0f0833bf06b5e2be09082ce78e4900d47dc9552de4f897fd02e4510550fea1b8bab819bda15debc63619ca341d1f9ca7386e3c5d1640934c

Download Submit
memory/792-12-0x0000000001880000-0x0000000001884000-memory.dmp

Filesize
16KB

Download
memory/3812-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3812-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3812-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3812-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3812-17-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/3812-18-0x00000000055A0000-0x00000000055F4000-memory.dmp

Filesize
336KB

Download
memory/3812-20-0x0000000005C60000-0x0000000006204000-memory.dmp

Filesize
5.6MB

Download
memory/3812-19-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/3812-22-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/3812-21-0x0000000005630000-0x0000000005682000-memory.dmp

Filesize
328KB

Download
memory/3812-42-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-62-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-82-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-197-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/3812-80-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-78-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-76-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-74-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-72-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-68-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-66-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-64-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-60-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-58-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-56-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-54-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-52-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-50-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-48-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-46-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-44-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-40-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-38-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-36-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-34-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-32-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-30-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-28-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-26-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-70-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-24-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-23-0x0000000005630000-0x000000000567D000-memory.dmp

Filesize
308KB

Download
memory/3812-1056-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/3812-1057-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/3812-1058-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3812-1059-0x0000000006E00000-0x0000000006E50000-memory.dmp

Filesize
320KB

Download
memory/3812-1060-0x0000000006EF0000-0x0000000006F82000-memory.dmp

Filesize
584KB

Download
memory/3812-1061-0x0000000006E60000-0x0000000006E6A000-memory.dmp

Filesize
40KB

Download
memory/3812-1062-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/3812-1063-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/3812-1064-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download
memory/3812-1065-0x0000000074470000-0x0000000074C20000-memory.dmp

Filesize
7.7MB

Download