agenttesla | 5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
08-12-2023 01:17

Target

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
Size

2.8MB
MD5

866d7ea6d629b641da79144a95b929f8
SHA1

46f55b35cbedeaa47a342e84bbecc53c791bf1fc
SHA256

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2
SHA512

b36a5fd13100405e836cf3ff5d72de0a2ec19ac9a332b13014d4c207048d9c1c7148fa16f19bb3224abf01719e94e2a584a0f58f43b85fad6c0903146fdf1c49
SSDEEP

49152:qeVIh937bl8Kaqe7rOsVsjkEPn4D//TM+j4uFEWnDEYTC77KommOtWdSXt8Gj:qeVsaKgbAn4D//IcbF/nDLTCHKomXyOF

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6940767976:AAEh_SwiKBJ04TyNZIrvXVlVIhsjEJabqkA/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2204	CasPol.exe
2204	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2204	CasPol.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28
PID 2000 wrote to memory of 2204	2000	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	28

memory/2000-0-0x0000000000A60000-0x0000000000D30000-memory.dmp

Filesize
2.8MB

Download
memory/2000-1-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-2-0x00000000004E0000-0x00000000004FA000-memory.dmp

Filesize
104KB

Download
memory/2000-3-0x0000000004EF0000-0x0000000004F30000-memory.dmp

Filesize
256KB

Download
memory/2000-4-0x0000000004FF0000-0x0000000005106000-memory.dmp

Filesize
1.1MB

Download
memory/2000-8-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2204-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2204-10-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2204-11-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-12-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2204-13-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-14-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download