agenttesla | 5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2023 01:17

Target

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
Size

2.8MB
MD5

866d7ea6d629b641da79144a95b929f8
SHA1

46f55b35cbedeaa47a342e84bbecc53c791bf1fc
SHA256

5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2
SHA512

b36a5fd13100405e836cf3ff5d72de0a2ec19ac9a332b13014d4c207048d9c1c7148fa16f19bb3224abf01719e94e2a584a0f58f43b85fad6c0903146fdf1c49
SSDEEP

49152:qeVIh937bl8Kaqe7rOsVsjkEPn4D//TM+j4uFEWnDEYTC77KommOtWdSXt8Gj:qeVsaKgbAn4D//IcbF/nDLTCHKomXyOF

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6940767976:AAEh_SwiKBJ04TyNZIrvXVlVIhsjEJabqkA/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	api.ipify.org
42	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2360	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
2360	AddInProcess32.exe
2360	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
Token: SeDebugPrivilege	2360	AddInProcess32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3460	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	97
PID 2808 wrote to memory of 3460	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	97
PID 2808 wrote to memory of 3460	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	97
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98
PID 2808 wrote to memory of 2360	2808	5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe	98

C:\Users\Admin\AppData\Local\Temp\5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe
"C:\Users\Admin\AppData\Local\Temp\5e1cd2b12844ca1a460d52d8edd67bf0e91f414a9165bc078318687797d66da2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:3460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 1972
    3⤵
    - Program crash
    PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2360 -ip 2360
1⤵
PID:3112

memory/2360-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2360-15-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2360-14-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/2360-13-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/2360-12-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2808-3-0x00000000057D0000-0x000000000586C000-memory.dmp

Filesize
624KB

Download
memory/2808-6-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Filesize
64KB

Download
memory/2808-7-0x0000000005910000-0x000000000591A000-memory.dmp

Filesize
40KB

Download
memory/2808-8-0x0000000006420000-0x0000000006536000-memory.dmp

Filesize
1.1MB

Download
memory/2808-5-0x0000000005960000-0x00000000059F2000-memory.dmp

Filesize
584KB

Download
memory/2808-11-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2808-4-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/2808-0-0x0000000074DE0000-0x0000000075590000-memory.dmp

Filesize
7.7MB

Download
memory/2808-2-0x0000000005710000-0x000000000572A000-memory.dmp

Filesize
104KB

Download
memory/2808-1-0x0000000000B50000-0x0000000000E20000-memory.dmp

Filesize
2.8MB

Download