agenttesla | bf8e9a24e677d3c559491d8e32210b46a4ded1a3cbae685d8afa85569d104e48

Analysis

max time kernel
17s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2023 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZAPLATA_.exe
Size

626KB
MD5

d938337b29065b1d0a4d4c375ac9b6ac
SHA1

0e439109d66f905b4c0643a4e55806373fc4e1f7
SHA256

743ae15d3849044f1e67fc43b58ad6a701bee9826e90ef6119ab9697835cd88d
SHA512

981390445d955c09df13f33d50a9ee341374cd33991820b33e05d45f20fd227737cf2ba422df6c97fad9b1200638fdb40173ac962d3f0491f87d5f5ac067876a
SSDEEP

12288:eNb45+po2GH2n0XKKx8pq4orY1H73FFIgLKyuJY5hhpNe1ifJlFUw+Huxm:Ka+pJwKKx8pqgb3YgLpvfXFUnHux

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.web4u.cz
Port:
587
Username:
[email protected]
Password:
sdft5472
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

ZAPLATA_.exe

description pid process target process

PID 4716 set thread context of 2272 4716 ZAPLATA_.exe ZAPLATA_.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ZAPLATA_.exeZAPLATA_.exe

pid process

4716 ZAPLATA_.exe
4716 ZAPLATA_.exe
2272 ZAPLATA_.exe
2272 ZAPLATA_.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ZAPLATA_.exeZAPLATA_.exe

description pid process

Token: SeDebugPrivilege 4716 ZAPLATA_.exe
Token: SeDebugPrivilege 2272 ZAPLATA_.exe

flow	ioc
6	api.ipify.org

description	pid	process	target process
PID 4716 set thread context of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe

pid	process
4716	ZAPLATA_.exe
4716	ZAPLATA_.exe
2272	ZAPLATA_.exe
2272	ZAPLATA_.exe

description	pid	process
Token: SeDebugPrivilege	4716	ZAPLATA_.exe
Token: SeDebugPrivilege	2272	ZAPLATA_.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ZAPLATA_.exe

description	pid	process	target process
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe
PID 4716 wrote to memory of 2272	4716	ZAPLATA_.exe	ZAPLATA_.exe

C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe
"C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716

C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe
"C:\Users\Admin\AppData\Local\Temp\ZAPLATA_.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZAPLATA_.exe.log

Filesize
2KB

MD5
93d52c1bc7c38d958583ebbd3dc09cd4

SHA1
4c5ee6f9c9ae190c9a0cccb91fa2257ddcb8b0d5

SHA256
2905f3a06dd8907ddbcbe64389cffcc8a5273d1822e25f8bea385bdd01653c76

SHA512
dfc55c3247d7734c5a531fb5a3de689e8bb823e82c14ad6cab16923d50d51e03e5e86165a7d65b3059a66b67968b611368b010a6d9f755916b01ef7b67c5228e

Download Submit
memory/2272-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2272-19-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/2272-18-0x0000000006B30000-0x0000000006B80000-memory.dmp

Filesize
320KB

Download
memory/2272-14-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/2272-16-0x0000000005550000-0x00000000055B6000-memory.dmp

Filesize
408KB

Download
memory/2272-17-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4716-3-0x0000000006030000-0x00000000065D4000-memory.dmp

Filesize
5.6MB

Download
memory/4716-8-0x0000000006010000-0x000000000601A000-memory.dmp

Filesize
40KB

Download
memory/4716-9-0x00000000086D0000-0x000000000874A000-memory.dmp

Filesize
488KB

Download
memory/4716-7-0x0000000005DE0000-0x0000000005DE8000-memory.dmp

Filesize
32KB

Download
memory/4716-6-0x0000000005C90000-0x0000000005CA8000-memory.dmp

Filesize
96KB

Download
memory/4716-5-0x0000000005C80000-0x0000000005C8A000-memory.dmp

Filesize
40KB

Download
memory/4716-15-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4716-1-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4716-4-0x0000000005B80000-0x0000000005C12000-memory.dmp

Filesize
584KB

Download
memory/4716-10-0x0000000008490000-0x000000000852C000-memory.dmp

Filesize
624KB

Download
memory/4716-0-0x0000000000F10000-0x0000000000FB2000-memory.dmp

Filesize
648KB

Download
memory/4716-2-0x00000000058C0000-0x00000000058D0000-memory.dmp

Filesize
64KB

Download