agenttesla | 06ab08fdf6ceb0fa8b5727125434b3d1096522b31a7d2aa13e82138927f78632

Analysis

max time kernel
18s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Dekont-08-22-23-745469873098789878987678987987.DOC.exe
Size

666KB
MD5

3655f4dbfd555dcf3ae7be88e4dcc132
SHA1

b678e4d2866c5bfe112b3c7b7b5edab96159db8f
SHA256

5808dc380418fc0add23fdcd7aeb82a4255955874c8242490d678f962bf0292b
SHA512

870617ee16a0e67a279c7477b7b1f8fdc3912e44ea05d9b802c34e64bd6201eaa3cae1dc5d83aa39b03ccdc9b4cd5b3fbb1d4ba1cdebc89aefc971da562376f6
SSDEEP

12288:6l1kPga5rr6bVHTPqH2fzXUq6y7DIvzEPMCrHxEqvIMwcjsdbXsTQiC9KmKDOlOe:67a5rGtigzEq370vzIrR1IM6us9KVDF1

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.aksumer.com
Port:
21
Username:
aksumerc
Password:
211116.kS*-

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3504	Dekont-08-22-23-745469873098789878987678987987.DOC.exe
3504	Dekont-08-22-23-745469873098789878987678987987.DOC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	Dekont-08-22-23-745469873098789878987678987987.DOC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99
PID 4496 wrote to memory of 3504	4496	Dekont-08-22-23-745469873098789878987678987987.DOC.exe	99

C:\Users\Admin\AppData\Local\Temp\Dekont-08-22-23-745469873098789878987678987987.DOC.exe
"C:\Users\Admin\AppData\Local\Temp\Dekont-08-22-23-745469873098789878987678987987.DOC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\Dekont-08-22-23-745469873098789878987678987987.DOC.exe
  "C:\Users\Admin\AppData\Local\Temp\Dekont-08-22-23-745469873098789878987678987987.DOC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont-08-22-23-745469873098789878987678987987.DOC.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/3504-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3504-19-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/3504-18-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3504-17-0x0000000006610000-0x0000000006660000-memory.dmp

Filesize
320KB

Download
memory/3504-14-0x0000000005100000-0x0000000005166000-memory.dmp

Filesize
408KB

Download
memory/3504-16-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/3504-13-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4496-8-0x00000000066F0000-0x000000000676A000-memory.dmp

Filesize
488KB

Download
memory/4496-0-0x00000000001C0000-0x000000000026C000-memory.dmp

Filesize
688KB

Download
memory/4496-7-0x0000000006010000-0x000000000601E000-memory.dmp

Filesize
56KB

Download
memory/4496-6-0x0000000005EE0000-0x0000000005EFA000-memory.dmp

Filesize
104KB

Download
memory/4496-15-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/4496-5-0x0000000004D20000-0x0000000004D2A000-memory.dmp

Filesize
40KB

Download
memory/4496-4-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4496-9-0x0000000008D60000-0x0000000008DFC000-memory.dmp

Filesize
624KB

Download
memory/4496-3-0x0000000004C50000-0x0000000004CE2000-memory.dmp

Filesize
584KB

Download
memory/4496-2-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/4496-1-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download