agenttesla | d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002

Analysis

max time kernel
151s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2022 14:34

Target

d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe
Size

930KB
MD5

f4669b8159d06fd545b1bcf07507ff54
SHA1

0544a42fc5d4b443a9e07b1ff24a65bfa309b7fd
SHA256

d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002
SHA512

8887f432064ffe706959a53496bf0a182d8c52eab3c715bda31b2df346903e67818fe5400acd14c9a5888589324f1191c17b0515448a41bd8b463fd9c85aaed2
SSDEEP

24576:IHZFWD781RX1k6zTkaSci1PcBk3WDxwg5+R:l7831kmAFPcUW7e

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot2134979594:AAFk4QkrlHlt2a-q-EhIoHZBbzxSH0QxiBI/sendDocument

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2596-139-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Drops file in Drivers directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe

description	pid	process	target process
PID 2896 set thread context of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exeRegSvcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe
Token: SeDebugPrivilege	2596	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe

description	pid	process	target process
PID 2896 wrote to memory of 4920	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 4920	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 4920	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe
PID 2896 wrote to memory of 2596	2896	d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe
"C:\Users\Admin\AppData\Local\Temp\d24842b404e95766700c3f37cc0e6266beebd1533082ec7d4443ee61637a2002.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:4920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Drops file in Drivers directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596

memory/2596-138-0x0000000000000000-mapping.dmp

Download
memory/2596-139-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2596-140-0x0000000005F20000-0x0000000005F86000-memory.dmp

Filesize
408KB

Download
memory/2896-132-0x00000000004F0000-0x00000000005DE000-memory.dmp

Filesize
952KB

Download
memory/2896-133-0x00000000055A0000-0x0000000005B44000-memory.dmp

Filesize
5.6MB

Download
memory/2896-134-0x0000000004FF0000-0x0000000005082000-memory.dmp

Filesize
584KB

Download
memory/2896-135-0x0000000005090000-0x000000000512C000-memory.dmp

Filesize
624KB

Download
memory/2896-136-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Filesize
40KB

Download
memory/4920-137-0x0000000000000000-mapping.dmp

Download