agenttesla | 1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8

Analysis

max time kernel
17s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Samples 1/2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
Size

771KB
MD5

7f76661ae3b0692fb7e422b5d6094fd0
SHA1

0e3c626cd190ae02fc3addecc83927076a34802a
SHA256

2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f
SHA512

693a826997a6ecde662d41919a39b87cc64bef31adc06c108f61d8415fd410a1f87ad62b9cbc6e3ca223ee0f72b117fdaaa39ae6d2c067de62617a0da6162669
SSDEEP

24576:yCzbiITNmDIdUatqhV5OqRFJeeXYJbGEfE:Xzbi8pqhbvXYJbGs

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.tecnosilos.com.py
Port:
587
Username:
[email protected]
Password:
38q{r,bs)M;E
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

description	pid	process	target process
PID 4548 set thread context of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

pid	process
4840	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
4840	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

description pid process

Token: SeDebugPrivilege 4840 2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

description	pid	process
Token: SeDebugPrivilege	4840	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

description	pid	process	target process
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
PID 4548 wrote to memory of 4840	4548	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe	2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe

C:\Users\Admin\AppData\Local\Temp\Samples 1\2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 1\2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4548

C:\Users\Admin\AppData\Local\Temp\Samples 1\2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 1\2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2c17c6ecd63459b4442629093178ca786b4754244e1d879cef8520ce3e471d4f.exe.log
Filesize
1KB

MD5
b7b9acb869ccc7f7ecb5304ec0384dee

SHA1
6a90751c95817903ee833d59a0abbef425a613b3

SHA256
8cb00a15cd942a1861c573d86d6fb430512c8e2f80f6349f48b16b8709ca7aa4

SHA512
7bec881ac5f59ac26f1be1e7e26d63f040c06369de10c1c246e531a4395d27c335d9acc647ecdedb48ed37bdc2dc405a4cfc11762e1c00659a49be259eaf8764

Download Submit
memory/4548-10-0x0000000009910000-0x00000000099AC000-memory.dmp

Filesize
624KB

Download
memory/4548-15-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download
memory/4548-9-0x0000000007250000-0x00000000072E8000-memory.dmp

Filesize
608KB

Download
memory/4548-4-0x0000000005670000-0x00000000059C4000-memory.dmp

Filesize
3.3MB

Download
memory/4548-5-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/4548-6-0x0000000005B60000-0x0000000005B6A000-memory.dmp

Filesize
40KB

Download
memory/4548-7-0x00000000071A0000-0x00000000071AE000-memory.dmp

Filesize
56KB

Download
memory/4548-8-0x0000000006BB0000-0x0000000006BBA000-memory.dmp

Filesize
40KB

Download
memory/4548-0-0x0000000000A70000-0x0000000000B36000-memory.dmp

Filesize
792KB

Download
memory/4548-3-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/4548-1-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download
memory/4548-2-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download
memory/4840-22-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4840-16-0x0000000005A10000-0x0000000005A20000-memory.dmp

Filesize
64KB

Download
memory/4840-17-0x0000000005A20000-0x0000000005A86000-memory.dmp

Filesize
408KB

Download
memory/4840-11-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4840-20-0x0000000006930000-0x0000000006980000-memory.dmp

Filesize
320KB

Download
memory/4840-21-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download
memory/4840-14-0x00000000751F0000-0x00000000759A0000-memory.dmp

Filesize
7.7MB

Download