agenttesla | 53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-01-2024 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe
Size

187KB
MD5

013e8e19e4328d222482235a1835b29d
SHA1

93349642b19fc317ceee44198114859b301c411b
SHA256

53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68
SHA512

81bed92d4abe364e2e1fa6d6e6d6bfbc08eebcd0baa6fe1706791bb7c548d0f16561801ca8e29819a782c6e321bd0ce651282dc6d28df2e0a293feb76e89d7df
SSDEEP

3072:kn8Ym0oaRkMYeFW1EjrMdCIHLCbQYpSFPV2ZcF1nzJLXOyYiUxcAOq9OPbavq6p7:YU86eCoAdXLEFtvq61f

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.cornery.com.my
Port:
587
Username:
[email protected]
Password:
Market321*

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cornery.com.my
Port:
587
Username:
[email protected]
Password:
Market321*
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
21	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3684 set thread context of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4624	CasPol.exe
4624	CasPol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe
Token: SeDebugPrivilege	4624	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4624	CasPol.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89
PID 3684 wrote to memory of 4624	3684	53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe	89

C:\Users\Admin\AppData\Local\Temp\53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe
"C:\Users\Admin\AppData\Local\Temp\53c826ee416baebb2d73add7056203ec3147c400f13fa8c1f025e2437aab8b68.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3684-0-0x00000000002D0000-0x0000000000304000-memory.dmp

Filesize
208KB

Download
memory/3684-1-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/3684-2-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/3684-3-0x0000000007080000-0x000000000711C000-memory.dmp

Filesize
624KB

Download
memory/3684-4-0x0000000007120000-0x00000000071B8000-memory.dmp

Filesize
608KB

Download
memory/3684-6-0x00000000054F0000-0x000000000550A000-memory.dmp

Filesize
104KB

Download
memory/3684-5-0x0000000007770000-0x0000000007D14000-memory.dmp

Filesize
5.6MB

Download
memory/3684-10-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/4624-9-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/4624-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4624-12-0x00000000059B0000-0x0000000005A16000-memory.dmp

Filesize
408KB

Download
memory/4624-11-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/4624-13-0x0000000006DB0000-0x0000000006E00000-memory.dmp

Filesize
320KB

Download
memory/4624-14-0x0000000075250000-0x0000000075A00000-memory.dmp

Filesize
7.7MB

Download
memory/4624-15-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/4624-16-0x0000000006FE0000-0x0000000007072000-memory.dmp

Filesize
584KB

Download
memory/4624-17-0x0000000006F60000-0x0000000006F6A000-memory.dmp

Filesize
40KB

Download