agenttesla | b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 01:17

Target

b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe
Size

1.1MB
MD5

c71613619a1a7ee2c7e0a35555779b8f
SHA1

1ea5eb485436b9f89fae9192e671ee66e9d7e404
SHA256

b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c
SHA512

2110f614ad971d3b3c0ae70dec4601581f24f9de537e3c711e38e91a3c9d4fb2079d47e929e8fee42b67437065f1f0d6a53b7efd8c7de2bf97125cdc0ae37989
SSDEEP

24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8a2pkX/VT2P0:9TvC/MTQYxsWR7a2pg/VU

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2500	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2168	RegSvcs.exe
2168	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2168	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2168	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	28
PID 2500 wrote to memory of 2100	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	29
PID 2500 wrote to memory of 2100	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	29
PID 2500 wrote to memory of 2100	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	29
PID 2500 wrote to memory of 2100	2500	b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe	29

C:\Users\Admin\AppData\Local\Temp\b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe
"C:\Users\Admin\AppData\Local\Temp\b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\b3df1390c298d38d58f43569a1a0cb95cf1ed7450d02eadbdab1524abeb7484c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 300
  2⤵
  - Program crash
  PID:2100

memory/2168-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2168-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2168-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2168-16-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-17-0x0000000000F40000-0x0000000000F80000-memory.dmp

Filesize
256KB

Download
memory/2168-18-0x00000000747E0000-0x0000000074ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-19-0x0000000000F40000-0x0000000000F80000-memory.dmp

Filesize
256KB

Download
memory/2500-10-0x0000000000300000-0x0000000000304000-memory.dmp

Filesize
16KB

Download