agenttesla | 00deb73a1738a3b3bfd9504b70775d668581f504481c7f37c20831504f9b77aa

Analysis

max time kernel
5s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

сентябрь 2023(570)/0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
Size

401KB
MD5

f111e4ac9108f1bdbb1205b23abe1d28
SHA1

66484a2da4e8a5c63c2f0ff551c281b9b9e031cc
SHA256

0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25
SHA512

b2c032ba315415b15ef8e020f4472c29e56e3a1de69a2e126bfd5c5ca2581ffdcd7cb17fffb0656c4306b058fc740d1bb31dc165eaff447896faf9254bd7bdf7
SSDEEP

12288:GYIro7VTc2oUVyl793J0rUrWbcG9m+gkOYTth:GYKo5Tcu0993Sgi94gOGth

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Executes dropped EXE 2 IoCs

Processes:

qjtrdfqx.exeqjtrdfqx.exe

pid process

3036 qjtrdfqx.exe
3064 qjtrdfqx.exe
Loads dropped DLL 2 IoCs

Processes:

0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exeqjtrdfqx.exe

pid process

2928 0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
3036 qjtrdfqx.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

qjtrdfqx.exe

description pid process target process

PID 3036 set thread context of 3064 3036 qjtrdfqx.exe qjtrdfqx.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

qjtrdfqx.exe

pid process

3064 qjtrdfqx.exe
3064 qjtrdfqx.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

qjtrdfqx.exe

pid process

3036 qjtrdfqx.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

qjtrdfqx.exe

description pid process

Token: SeDebugPrivilege 3064 qjtrdfqx.exe

pid	process
3036	qjtrdfqx.exe
3064	qjtrdfqx.exe

pid	process
2928	0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
3036	qjtrdfqx.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 3036 set thread context of 3064	3036	qjtrdfqx.exe	qjtrdfqx.exe

pid	process
3064	qjtrdfqx.exe
3064	qjtrdfqx.exe

pid	process
3036	qjtrdfqx.exe

description	pid	process
Token: SeDebugPrivilege	3064	qjtrdfqx.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exeqjtrdfqx.exe

description	pid	process	target process
PID 2928 wrote to memory of 3036	2928	0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe	qjtrdfqx.exe
PID 2928 wrote to memory of 3036	2928	0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe	qjtrdfqx.exe
PID 2928 wrote to memory of 3036	2928	0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe	qjtrdfqx.exe
PID 2928 wrote to memory of 3036	2928	0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe	qjtrdfqx.exe
PID 3036 wrote to memory of 3064	3036	qjtrdfqx.exe	qjtrdfqx.exe
PID 3036 wrote to memory of 3064	3036	qjtrdfqx.exe	qjtrdfqx.exe
PID 3036 wrote to memory of 3064	3036	qjtrdfqx.exe	qjtrdfqx.exe
PID 3036 wrote to memory of 3064	3036	qjtrdfqx.exe	qjtrdfqx.exe
PID 3036 wrote to memory of 3064	3036	qjtrdfqx.exe	qjtrdfqx.exe

C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe
"C:\Users\Admin\AppData\Local\Temp\сентябрь 2023(570)\0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928

C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe
"C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe
"C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3036-6-0x0000000000170000-0x0000000000172000-memory.dmp

Filesize
8KB

Download
memory/3064-21-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3064-18-0x0000000000230000-0x0000000000272000-memory.dmp

Filesize
264KB

Download
memory/3064-15-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-20-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3064-19-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3064-17-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3064-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-10-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/3064-16-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/3064-22-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/3064-23-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download
memory/3064-24-0x0000000004840000-0x0000000004880000-memory.dmp

Filesize
256KB

Download