agenttesla | eecea13ce174c0e1a8f3799ded4f4862085ea3f1b3f305d610f662465dff8fbd

Analysis

max time kernel
186s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2023, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOKUMEN_BPN_KKST002_01300096400460026.exe
Size 937KB
Sample230116-rtkc2age83
SHA256 eecea13ce174c0e1a8f3799ded4f4862085ea3f1b3f305d610f662465dff8fbd
MD5 0d2b990d3f1e8210a0a59aedb5ecfd2d
SHA1 67262402b86b3f1802c205506134dc024c4301af
SHA512 6d3a5c575c57b6e28a574f415cd2db1994b78716f8a6cee84df6d028d0c674bc1b08b93d0d58cc04f72f8ff2f0f85e33c8e8daba9c768aa3b1ec6b446c01f558
SSDEEP 24576:kzPDJl8euDi4BJj3hBecb3ewHdqoXpDDL:EPDJl8euxdhBecb/1L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.linksportsinc.com
Port
587
Username
[email protected]
Password
Camil2017@@
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1396 set thread context of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3596	DOKUMEN_BPN_KKST002_01300096400460026.exe
3596	DOKUMEN_BPN_KKST002_01300096400460026.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	DOKUMEN_BPN_KKST002_01300096400460026.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84
PID 1396 wrote to memory of 3596	1396	DOKUMEN_BPN_KKST002_01300096400460026.exe	84

C:\Users\Admin\AppData\Local\Temp\DOKUMEN_BPN_KKST002_01300096400460026.exe
"C:\Users\Admin\AppData\Local\Temp\DOKUMEN_BPN_KKST002_01300096400460026.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Users\Admin\AppData\Local\Temp\DOKUMEN_BPN_KKST002_01300096400460026.exe
  "C:\Users\Admin\AppData\Local\Temp\DOKUMEN_BPN_KKST002_01300096400460026.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

DOKUMEN_BPN_KKST002_01300096400460026.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DOKUMEN_BPN_KKST002_01300096400460026.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
MD5 SHA1 SHA512

Submit Download

memory/1396-132-0x0000000000AE0000-0x0000000000BD0000-memory.dmp

Download

memory/1396-133-0x0000000005B90000-0x0000000006134000-memory.dmp

Download

memory/1396-134-0x00000000055E0000-0x0000000005672000-memory.dmp

Download

memory/1396-135-0x0000000005570000-0x000000000557A000-memory.dmp

Download

memory/1396-136-0x0000000005850000-0x00000000058EC000-memory.dmp

Download

memory/3596-138-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3596-140-0x00000000062D0000-0x0000000006336000-memory.dmp

Download