agenttesla | 53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 01:31

Target

53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe
Size

187KB
MD5

013e8e19e4328d222482235a1835b29d
SHA1

93349642b19fc317ceee44198114859b301c411b
SHA256

53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68
SHA512

81bed92d4abe364e2e1fa6d6e6d6bfbc08eebcd0baa6fe1706791bb7c548d0f16561801ca8e29819a782c6e321bd0ce651282dc6d28df2e0a293feb76e89d7df
SSDEEP

3072:kn8Ym0oaRkMYeFW1EjrMdCIHLCbQYpSFPV2ZcF1nzJLXOyYiUxcAOq9OPbavq6p7:YU86eCoAdXLEFtvq61f

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org
8	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe
2708	AddInProcess32.exe
2708	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe
Token: SeDebugPrivilege	2708	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2708	AddInProcess32.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2908	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	28
PID 2180 wrote to memory of 2908	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	28
PID 2180 wrote to memory of 2908	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	28
PID 2180 wrote to memory of 2908	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	28
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29
PID 2180 wrote to memory of 2708	2180	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	29

C:\Users\Admin\AppData\Local\Temp\53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe
"C:\Users\Admin\AppData\Local\Temp\53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:2908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2708

memory/2180-0-0x00000000003D0000-0x0000000000404000-memory.dmp

Filesize
208KB

Download
memory/2180-1-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2180-2-0x0000000004CC0000-0x0000000004D00000-memory.dmp

Filesize
256KB

Download
memory/2180-3-0x0000000001D30000-0x0000000001DC8000-memory.dmp

Filesize
608KB

Download
memory/2180-4-0x0000000001DD0000-0x0000000001DEA000-memory.dmp

Filesize
104KB

Download
memory/2180-8-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2708-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-11-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2708-12-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2708-13-0x0000000004940000-0x0000000004980000-memory.dmp

Filesize
256KB

Download