agenttesla | 46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464

Analysis

max time kernel
131s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe
Size 350KB
Sample240206-srwhysbgem
SHA256 46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464
MD5 4f68e660ec4e71adc93ed2d47e0be5e2
SHA1 75efc8b00e6535667ac1b48e9f8349ea0c0cb628
SHA512 4dd34e21e18e41e29744793207ecf134b62a74b5697b9f45c09ed8af0e6a6329ee62e5f2cef5bf4bb8c3f1f30348167b25daab587c30113f538042718aace70a
SSDEEP 3072:/G24BR9OWwm3RpxszvSDA+Ii7XZyQjHgyVo900zYgbh9Q9dDzbR0yiR2yit2k7Gn:tyhwmmv0AP6V00nic9/HWkiKi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://discord.com/api/webhooks/1201267552622477446/eLGQ4lmofkh0zrpLn2k5CRdEZBWRzpA63gSbTgqw5jtBQxv7qbjyA3EZ5GJYz-KnwBl7

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
56	api.ipify.org
58	api.ipify.org
62	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3448 set thread context of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe
3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe
3780	aspnet_compiler.exe
3780	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe
Token: SeDebugPrivilege	3780	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3780	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 636	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	84
PID 3448 wrote to memory of 636	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	84
PID 3448 wrote to memory of 636	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	84
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85
PID 3448 wrote to memory of 3780	3448	46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe	85

C:\Users\Admin\AppData\Local\Temp\46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe
"C:\Users\Admin\AppData\Local\Temp\46be5a44d8b7c61a1a7fd2e1d31f7146c6ca1659bb188534fd90b8c191e9b464.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3448-10-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

memory/3448-1-0x0000000000570000-0x00000000005CC000-memory.dmp

Download

memory/3448-2-0x00000000073E0000-0x0000000007438000-memory.dmp

Download

memory/3448-3-0x00000000079F0000-0x0000000007F94000-memory.dmp

Download

memory/3448-4-0x00000000074F0000-0x0000000007582000-memory.dmp

Download

memory/3448-5-0x0000000002800000-0x0000000002806000-memory.dmp

Download

memory/3448-6-0x0000000005030000-0x0000000005040000-memory.dmp

Download

memory/3448-7-0x0000000002890000-0x000000000289A000-memory.dmp

Download

memory/3448-0-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

memory/3780-8-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/3780-11-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

memory/3780-12-0x0000000005630000-0x0000000005640000-memory.dmp

Download

memory/3780-13-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/3780-14-0x00000000748B0000-0x0000000075060000-memory.dmp

Download

memory/3780-15-0x0000000005630000-0x0000000005640000-memory.dmp

Download

memory/3780-16-0x0000000006A40000-0x0000000006A90000-memory.dmp

Download

memory/3780-17-0x0000000006AD0000-0x0000000006ADA000-memory.dmp

Download