agenttesla | bf8e9a24e677d3c559491d8e32210b46a4ded1a3cbae685d8afa85569d104e48

Analysis

max time kernel
18s
max time network
122s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
05-12-2023 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZAPLATA_.exe
Size

626KB
MD5

d938337b29065b1d0a4d4c375ac9b6ac
SHA1

0e439109d66f905b4c0643a4e55806373fc4e1f7
SHA256

743ae15d3849044f1e67fc43b58ad6a701bee9826e90ef6119ab9697835cd88d
SHA512

981390445d955c09df13f33d50a9ee341374cd33991820b33e05d45f20fd227737cf2ba422df6c97fad9b1200638fdb40173ac962d3f0491f87d5f5ac067876a
SSDEEP

12288:eNb45+po2GH2n0XKKx8pq4orY1H73FFIgLKyuJY5hhpNe1ifJlFUw+Huxm:Ka+pJwKKx8pqgb3YgLpvfXFUnHux

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.web4u.cz
Port:
587
Username:
[email protected]
Password:
sdft5472
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

ZAPLATA_.exe

description pid process target process

PID 3028 set thread context of 2928 3028 ZAPLATA_.exe ZAPLATA_.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ZAPLATA_.exeZAPLATA_.exe

pid process

3028 ZAPLATA_.exe
3028 ZAPLATA_.exe
2928 ZAPLATA_.exe
2928 ZAPLATA_.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ZAPLATA_.exeZAPLATA_.exe

description pid process

Token: SeDebugPrivilege 3028 ZAPLATA_.exe
Token: SeDebugPrivilege 2928 ZAPLATA_.exe

flow	ioc
2	api.ipify.org

description	pid	process	target process
PID 3028 set thread context of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe

pid	process
3028	ZAPLATA_.exe
3028	ZAPLATA_.exe
2928	ZAPLATA_.exe
2928	ZAPLATA_.exe

description	pid	process
Token: SeDebugPrivilege	3028	ZAPLATA_.exe
Token: SeDebugPrivilege	2928	ZAPLATA_.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ZAPLATA_.exe

description	pid	process	target process
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe
PID 3028 wrote to memory of 2928	3028	ZAPLATA_.exe	ZAPLATA_.exe

C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe
"C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe
"C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2928-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2928-20-0x0000000004CB0000-0x0000000004CF0000-memory.dmp

Filesize
256KB

Download
memory/2928-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2928-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2928-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2928-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2928-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2928-18-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2928-21-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/2928-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3028-2-0x0000000000E20000-0x0000000000E60000-memory.dmp

Filesize
256KB

Download
memory/3028-0-0x0000000001040000-0x00000000010E2000-memory.dmp

Filesize
648KB

Download
memory/3028-1-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download
memory/3028-6-0x0000000005F60000-0x0000000005FDA000-memory.dmp

Filesize
488KB

Download
memory/3028-4-0x0000000000290000-0x0000000000298000-memory.dmp

Filesize
32KB

Download
memory/3028-5-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/3028-3-0x0000000000270000-0x0000000000288000-memory.dmp

Filesize
96KB

Download
memory/3028-19-0x00000000743C0000-0x0000000074AAE000-memory.dmp

Filesize
6.9MB

Download