agenttesla | 0ec323f55808814136b3c1059277ac2a2753955676218a13aacc73565fea684e

Analysis

max time kernel
114s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2023 07:55

Target

5e32b356e47560e7920fe291ab2d0c6c.exe
Size

1.0MB
MD5

5e32b356e47560e7920fe291ab2d0c6c
SHA1

950d0ac0deb7bba590731dcdf879cb5156214abb
SHA256

0ec323f55808814136b3c1059277ac2a2753955676218a13aacc73565fea684e
SHA512

59c1935d2cb6b3147e5155cc7d273b0dc4aee0f54be9a82891ccefd066fa8418c1fb5ad1fa3a1add131cc8e1c4a56b801b20aaf08b8ba5e45636e1a43fd3de12
SSDEEP

24576:X/91i2tfLlwQiAgf2rf58SdKMFyZ6uKrXjk71IgGhr1k1+PbZo12a6z:XXFSMgf2zVpHw2pagzZo1w

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot5866032214:AAFIOyXMBAXtSDPbd1lqRSgP4WSftaTimg4/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

5e32b356e47560e7920fe291ab2d0c6c.exe

description pid process target process

PID 3436 set thread context of 4184 3436 5e32b356e47560e7920fe291ab2d0c6c.exe cvtres.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5e32b356e47560e7920fe291ab2d0c6c.execvtres.exe

pid process

3436 5e32b356e47560e7920fe291ab2d0c6c.exe
3436 5e32b356e47560e7920fe291ab2d0c6c.exe
4184 cvtres.exe
4184 cvtres.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

5e32b356e47560e7920fe291ab2d0c6c.execvtres.exe

description pid process

Token: SeDebugPrivilege 3436 5e32b356e47560e7920fe291ab2d0c6c.exe
Token: SeDebugPrivilege 4184 cvtres.exe

flow	ioc
15	ip-api.com

description	pid	process	target process
PID 3436 set thread context of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe

description	pid	process
Token: SeDebugPrivilege	3436	5e32b356e47560e7920fe291ab2d0c6c.exe
Token: SeDebugPrivilege	4184	cvtres.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5e32b356e47560e7920fe291ab2d0c6c.exe

description	pid	process	target process
PID 3436 wrote to memory of 3900	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 3900	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 3900	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe
PID 3436 wrote to memory of 4184	3436	5e32b356e47560e7920fe291ab2d0c6c.exe	cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
2⤵
PID:3900

memory/3436-7-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/3436-1-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/3436-2-0x0000000005180000-0x0000000005190000-memory.dmp

Filesize
64KB

Download
memory/3436-3-0x0000000002A50000-0x0000000002A5A000-memory.dmp

Filesize
40KB

Download
memory/3436-0-0x00000000003A0000-0x00000000004A4000-memory.dmp

Filesize
1.0MB

Download
memory/4184-9-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/4184-8-0x0000000005630000-0x0000000005BD4000-memory.dmp

Filesize
5.6MB

Download
memory/4184-6-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/4184-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4184-10-0x0000000005180000-0x00000000051E6000-memory.dmp

Filesize
408KB

Download
memory/4184-11-0x00000000063F0000-0x0000000006440000-memory.dmp

Filesize
320KB

Download
memory/4184-12-0x00000000064E0000-0x000000000657C000-memory.dmp

Filesize
624KB

Download
memory/4184-13-0x0000000006860000-0x00000000068F2000-memory.dmp

Filesize
584KB

Download
memory/4184-14-0x0000000006820000-0x000000000682A000-memory.dmp

Filesize
40KB

Download
memory/4184-15-0x00000000750B0000-0x0000000075860000-memory.dmp

Filesize
7.7MB

Download
memory/4184-16-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download