agenttesla | 2c112aa6303f06bac17ef65b8e3aa5cfd582e2aaf04e0036c39216d8965ad804

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2023, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rDocumentosdeembarqueCI.exe
Size 1.1MB
Sample231221-vb858adfe2
SHA256 2c112aa6303f06bac17ef65b8e3aa5cfd582e2aaf04e0036c39216d8965ad804
MD5 2b8d52006fc4f5c0dd8dac75f2d315ae
SHA1 2068d5fc7c011f5356c0e419a8d4e1836ac635d1
SHA512 0d4964dc4e79c737422ec0301a1dd75e326dd2b4c7fa55c861eb9914c8d9c0beb5795353d631626cca9bb7b88881de2fa3ea90bb4b4784ef39eaebecc95c470d
SSDEEP 24576:ek70TrcN/imA7oFkT2F5RvrFyBWTipXFT:ekQTANahcG23RjUBRpXFT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://discord.com/api/webhooks/1186834019627827270/y0S-n-hBE1jR15tIr1j1sESR1UsUyFoPzm0ZqLatEGGEP8xXdU9hk3RwMYMEZqV8QFo2

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 5016	4284	rDocumentosdeembarqueCI.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5032	5016	WerFault.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	aspnet_compiler.exe
5016	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90
PID 4284 wrote to memory of 5016	4284	rDocumentosdeembarqueCI.exe	90

C:\Users\Admin\AppData\Local\Temp\rDocumentosdeembarqueCI.exe
"C:\Users\Admin\AppData\Local\Temp\rDocumentosdeembarqueCI.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1376
    3⤵
    - Program crash
    PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5016 -ip 5016
1⤵
PID:4172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4284-6-0x00000000027A0000-0x00000000027AA000-memory.dmp

Download

memory/4284-14-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/4284-2-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/4284-3-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/4284-4-0x0000000005040000-0x00000000055E4000-memory.dmp

Download

memory/4284-5-0x0000000004E50000-0x0000000004F3C000-memory.dmp

Download

memory/4284-7-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/4284-1-0x0000000004F40000-0x000000000502E000-memory.dmp

Download

memory/4284-0-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/5016-13-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/5016-11-0x00000000054A0000-0x00000000054B0000-memory.dmp

Download

memory/5016-12-0x0000000005420000-0x0000000005486000-memory.dmp

Download

memory/5016-8-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5016-10-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download