agenttesla | 39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
11-12-2023 13:25

Target

39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe
Size

240KB
MD5

285c79216d7884f1cd6514c04f16357b
SHA1

5e877ad4900eb68a8ae16fb96232eaa0dfc1b09b
SHA256

39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e
SHA512

c4797ec6efe546458a2d054ae2bec0bae3e1ed56e74e86fe13ce8c5c3a22d1ed1cedc15c54bbf7b101015699d64ce41151ff5887cd23139a1798c9c71e540d81
SSDEEP

3072:0tYHr3aD32duqAFjnmy5gB6njp8P6OUqHMeK:0tYHr3aD32duqKjmN6j2Q

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6471053992:AAFUlrUxhi5Jrpjikoc-P4r9ZbsXV_T9vj8/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	1684	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe
1684	39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2832	1684	39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe	29
PID 1684 wrote to memory of 2832	1684	39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe	29
PID 1684 wrote to memory of 2832	1684	39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe	29
PID 1684 wrote to memory of 2832	1684	39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe	29

C:\Users\Admin\AppData\Local\Temp\39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe
"C:\Users\Admin\AppData\Local\Temp\39df2e11bf25d5fa878ba25f8714116936f45400c6765f2b6212c860b79a3f0e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1432
  2⤵
  - Program crash
  PID:2832

memory/1684-0-0x0000000000120000-0x0000000000162000-memory.dmp

Filesize
264KB

Download
memory/1684-1-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-2-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download
memory/1684-3-0x0000000074520000-0x0000000074C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1684-4-0x00000000049C0000-0x0000000004A00000-memory.dmp

Filesize
256KB

Download