agenttesla | df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe
Size

272KB
MD5

05604b7d20a7d61c044d23bf9ee29acd
SHA1

ed4bc7b907ec9645d5dee53c527cccb2d38a5448
SHA256

df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e
SHA512

03fe4f53d017b6eaa0dcf5225598f220669c9b4f47d9f57b97f8845212e256419388249922cc364f532d945476869d789ab6a98e486365b96c265d16ca334601
SSDEEP

6144:q48F7QsyKtpw9hAcGTJscDoAb0XWRnTqAJ:KF7pye4hAc8oi0Xkz

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.etasimali.com
Port:
587
Username:
[email protected]
Password:
RECRUTEMENT@2023

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.etasimali.com
Port:
587
Username:
[email protected]
Password:
RECRUTEMENT@2023
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 api.ipify.org

flow	ioc
43	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe

description	pid	process	target process
PID 1976 set thread context of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Caspol.exe

pid process

4464 Caspol.exe
4464 Caspol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Caspol.exe

description pid process

Token: SeDebugPrivilege 4464 Caspol.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Caspol.exe

pid process

4464 Caspol.exe

pid	process
4464	Caspol.exe
4464	Caspol.exe

description	pid	process
Token: SeDebugPrivilege	4464	Caspol.exe

pid	process
4464	Caspol.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe

description	pid	process	target process
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe
PID 1976 wrote to memory of 4464	1976	df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe	Caspol.exe

C:\Users\Admin\AppData\Local\Temp\df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe
"C:\Users\Admin\AppData\Local\Temp\df6295dd1ead4d68fbd94b9bfb3818511def8111208b5aa3e4df8687a9fad51e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-9-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/1976-2-0x0000000007430000-0x0000000007524000-memory.dmp

Filesize
976KB

Download
memory/1976-0-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/1976-3-0x0000000004F00000-0x0000000004F22000-memory.dmp

Filesize
136KB

Download
memory/1976-4-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/1976-5-0x0000000004E60000-0x0000000004E6A000-memory.dmp

Filesize
40KB

Download
memory/1976-1-0x0000000000530000-0x0000000000574000-memory.dmp

Filesize
272KB

Download
memory/4464-8-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/4464-18-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/4464-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4464-11-0x00000000051A0000-0x0000000005206000-memory.dmp

Filesize
408KB

Download
memory/4464-12-0x0000000005220000-0x0000000005230000-memory.dmp

Filesize
64KB

Download
memory/4464-13-0x00000000068A0000-0x00000000068F0000-memory.dmp

Filesize
320KB

Download
memory/4464-14-0x0000000006990000-0x0000000006A2C000-memory.dmp

Filesize
624KB

Download
memory/4464-15-0x0000000006BD0000-0x0000000006C62000-memory.dmp

Filesize
584KB

Download
memory/4464-16-0x0000000006BA0000-0x0000000006BAA000-memory.dmp

Filesize
40KB

Download
memory/4464-17-0x0000000074CA0000-0x0000000075450000-memory.dmp

Filesize
7.7MB

Download
memory/4464-10-0x00000000056E0000-0x0000000005C84000-memory.dmp

Filesize
5.6MB

Download