agenttesla | 57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348

Analysis

max time kernel
188s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:18

Target

57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
Size

667KB
MD5

6c121aa807c7ffbc6259f7ac0dc83255
SHA1

f1cdbe4a3c1852feddf5f5ff1ff3d4498161760b
SHA256

57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348
SHA512

d07a82656b997515a4fe0899c2612e6feeb40c3786138eb1a990b11a85e0cfbd89ae4357d89a05baf64d5e897ce9dce69c457b4c6b1c6a2365e19a66e9802652
SSDEEP

12288:Xwc+pbKbfxpe/IbHn0svbXPEy6ggpdUx1ZRy8p7FJqfh4qw+:XjsbKje/I7dvbXP/6ggEfy8p7FJqJ4

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
79	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
4784	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
4784	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
Token: SeDebugPrivilege	4784	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3244	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	91
PID 220 wrote to memory of 3244	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	91
PID 220 wrote to memory of 3244	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	91
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92
PID 220 wrote to memory of 4784	220	57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe	92

C:\Users\Admin\AppData\Local\Temp\57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
"C:\Users\Admin\AppData\Local\Temp\57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Temp\57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
  "C:\Users\Admin\AppData\Local\Temp\57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe"
  2⤵
  PID:3244
- C:\Users\Admin\AppData\Local\Temp\57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe
  "C:\Users\Admin\AppData\Local\Temp\57bdaf6ec2126f43b1ab5e57fd8456f328f502e3f8deca3c41ebfb8f2e7c3348.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784

memory/220-132-0x0000000000E90000-0x0000000000F3E000-memory.dmp

Filesize
696KB

Download
memory/220-133-0x0000000005D90000-0x0000000006334000-memory.dmp

Filesize
5.6MB

Download
memory/220-134-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/220-135-0x0000000005790000-0x000000000579A000-memory.dmp

Filesize
40KB

Download
memory/220-136-0x00000000090B0000-0x000000000914C000-memory.dmp

Filesize
624KB

Download
memory/4784-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4784-140-0x0000000005B00000-0x0000000005B66000-memory.dmp

Filesize
408KB

Download