agenttesla | 7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9

Analysis

max time kernel
128s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 10:17

Target

7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe
Size

174KB
MD5

be62d81a6b1d8c145c4204743f5e0ae2
SHA1

8a62d24b0f38cd759d974f9cab8da5000c95e6d9
SHA256

7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9
SHA512

3b1ec702ab69b616419da7db10d0c3c19bdf4eb849c138ed877853c339db194fa4277f3ea1a9cf51666e4e789d254e6679fb67816d5e02d76b6bbad394d3b0cb
SSDEEP

1536:lAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgd:/+9wqY+mhhhmitqOW

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	api.ipify.org
21	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	Caspol.exe
1512	Caspol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe
Token: SeDebugPrivilege	1512	Caspol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	Caspol.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83
PID 4648 wrote to memory of 1512	4648	7f34ca6249b2e1d2b908765af70d5f3bfe645407c6ff65a3e2a24ffeb7b2ddc9exe_JC.exe	83

memory/1512-140-0x0000000005EB0000-0x0000000006454000-memory.dmp

Filesize
5.6MB

Download
memory/1512-142-0x0000000005900000-0x0000000005966000-memory.dmp

Filesize
408KB

Download
memory/1512-148-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/1512-136-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1512-147-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/1512-138-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/1512-146-0x0000000006E80000-0x0000000006E8A000-memory.dmp

Filesize
40KB

Download
memory/1512-144-0x0000000006EE0000-0x00000000070A2000-memory.dmp

Filesize
1.8MB

Download
memory/1512-145-0x0000000006DB0000-0x0000000006E42000-memory.dmp

Filesize
584KB

Download
memory/1512-143-0x0000000006CC0000-0x0000000006D10000-memory.dmp

Filesize
320KB

Download
memory/1512-141-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/4648-133-0x0000000000380000-0x00000000003B4000-memory.dmp

Filesize
208KB

Download
memory/4648-134-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4648-139-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4648-135-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download