agenttesla | 67a1d95ac501b3239795c12bdebe20853519e92810d5124bff570a5f9001d440

Analysis

max time kernel
128s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

satın alma emri.exe
Size

456KB
MD5

2c0f7daa0637923f321617d6bbc2c968
SHA1

da5f7fca6da24d2f065d68bc32a127089b7c42ed
SHA256

67a1d95ac501b3239795c12bdebe20853519e92810d5124bff570a5f9001d440
SHA512

89098cf7e98ad22b56ce7415db68a26afa1f3bd48c3611def7edb08242045140dd14de94e464840e36d7efb1ad5d3f72970120dd0d1e607359e2d6a0db6be3c7
SSDEEP

6144:z3IaL+ZdLqbt3de/e1L0U0iA3o4U5miBdthFjPLW5eVHtM3RirSdkbrs1aq:z9/p1gUVA3KxjzKeVHyRir5rs1j

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://discordapp.com/api/webhooks/1145251777952886784/YHlqQB8-CLI8j31rwP_EM7zqJEQJXxU_Oj2JYZGz03XJ2vHM4R3mj7a-WhMivxm2KvdV

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nvncq.vbs	satın alma emri.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4916 set thread context of 60	4916	satın alma emri.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
60	MSBuild.exe
60	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	satın alma emri.exe
Token: SeDebugPrivilege	60	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90
PID 4916 wrote to memory of 60	4916	satın alma emri.exe	90

C:\Users\Admin\AppData\Local\Temp\satın alma emri.exe
"C:\Users\Admin\AppData\Local\Temp\satın alma emri.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-1089-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/60-1091-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/60-1092-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/60-1093-0x0000000004E70000-0x0000000004ED6000-memory.dmp

Filesize
408KB

Download
memory/60-1094-0x0000000005C60000-0x0000000005CB0000-memory.dmp

Filesize
320KB

Download
memory/60-1096-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/60-1095-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4916-31-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-39-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-4-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4916-5-0x0000000004E60000-0x0000000004E6A000-memory.dmp

Filesize
40KB

Download
memory/4916-6-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-7-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-9-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-11-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-13-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-15-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-17-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-19-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-21-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-23-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-25-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-27-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-29-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-2-0x00000000054C0000-0x0000000005A64000-memory.dmp

Filesize
5.6MB

Download
memory/4916-33-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-35-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-37-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-3-0x0000000004F10000-0x0000000004FA2000-memory.dmp

Filesize
584KB

Download
memory/4916-41-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-43-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-47-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-45-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-49-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-51-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-53-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-55-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-57-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-59-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-61-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-63-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-65-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-67-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-1-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4916-0-0x00000000003F0000-0x0000000000468000-memory.dmp

Filesize
480KB

Download
memory/4916-69-0x0000000007850000-0x0000000007914000-memory.dmp

Filesize
784KB

Download
memory/4916-878-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download
memory/4916-1084-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Filesize
4KB

Download
memory/4916-1083-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/4916-1090-0x0000000074460000-0x0000000074C10000-memory.dmp

Filesize
7.7MB

Download