agenttesla | ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f

Analysis

max time kernel
62s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 01:10

Target

ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe
Size

611KB
MD5

90ef1b43841cec6ada8456d6001cdfab
SHA1

f4883709e25e8214a514a5a857d271ed522e2d1e
SHA256

ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f
SHA512

a64011db120874c49e0fa96cb56c2fe7be520654cfcc45a200f673185911d0d9936998e969f436310ad025fd191fe3901fc60669f9a50a53e99a4c92f1899b4f
SSDEEP

12288:3yhaWvkOpKFP5eJBXY2PYMK2A4x3t45Jb+uh1ZaxfJz1+Ce5x5udkBuuQRo:3yXoh6Rwyxt45Jnjaxf11kMLuQRo

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com

flow	ioc
3	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe

description	pid	process	target process
PID 1064 set thread context of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msbuild.exe

pid process

1296 msbuild.exe
1296 msbuild.exe

pid	process
1296	msbuild.exe
1296	msbuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exemsbuild.exe

description	pid	process
Token: SeDebugPrivilege	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe
Token: SeDebugPrivilege	1296	msbuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe

description	pid	process	target process
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 1296	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 4732	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 4732	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe
PID 1064 wrote to memory of 4732	1064	ccb6396aaae2620106b0aa3e7026ccfebc60f5026d3764e692a76e4cfbc4914f.exe	msbuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
2⤵
PID:4732

memory/1064-9-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/1064-1-0x00007FFDA3320000-0x00007FFDA3DE1000-memory.dmp

Filesize
10.8MB

Download
memory/1064-2-0x000001CDB8FD0000-0x000001CDB8FE0000-memory.dmp

Filesize
64KB

Download
memory/1064-3-0x000001CDB8E70000-0x000001CDB8F06000-memory.dmp

Filesize
600KB

Download
memory/1064-0-0x000001CDB71C0000-0x000001CDB71CA000-memory.dmp

Filesize
40KB

Download
memory/1296-8-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/1296-5-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1296-7-0x0000000005810000-0x0000000005820000-memory.dmp

Filesize
64KB

Download
memory/1296-6-0x0000000005EA0000-0x0000000006444000-memory.dmp

Filesize
5.6MB

Download
memory/1296-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1296-10-0x0000000006C70000-0x0000000006CC0000-memory.dmp

Filesize
320KB

Download
memory/1296-11-0x0000000006E10000-0x0000000006EA2000-memory.dmp

Filesize
584KB

Download
memory/1296-12-0x0000000006D10000-0x0000000006D1A000-memory.dmp

Filesize
40KB

Download
memory/1296-13-0x0000000074E70000-0x0000000075620000-memory.dmp

Filesize
7.7MB

Download
memory/1296-14-0x0000000005810000-0x0000000005820000-memory.dmp

Filesize
64KB

Download