agenttesla | 69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9

Analysis

max time kernel
88s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe
Size

35KB
MD5

e13f118e244caa9f239a6d6eaed6f56b
SHA1

35389ff25b75d439c83e540a023b15c6b92f1b8e
SHA256

69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9
SHA512

2218d8c266bb4a72964f8f65be9a79a2aee915df9e4716eebd67107d6ac8973749aba16acd76991ca0f4c7d739a7e7176c8325b929909ad57b4811ab0caa6188
SSDEEP

384:vMLwC6zvkHvrdvgJ/hcK8L3N6f5DXor78s/nqcF1uLfssuUIA+/doayii1l+M7si:0LwXzv2J2F5LUsTIbmapOl+M7rhQy

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
bulktz.com.ng
Port:
587
Username:
[email protected]
Password:
Babablue2024$

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
bulktz.com.ng
Port:
587
Username:
[email protected]
Password:
Babablue2024$
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	CasPol.exe
4848	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	CasPol.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85
PID 4648 wrote to memory of 4848	4648	69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe	85

C:\Users\Admin\AppData\Local\Temp\69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe
"C:\Users\Admin\AppData\Local\Temp\69d8d9e0455f70aa8025b37644f4e939ee3a9a2990f852085a5c4d44217a98d9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4648-8-0x000000000B5E0000-0x000000000B73C000-memory.dmp

Filesize
1.4MB

Download
memory/4648-0-0x0000000000060000-0x000000000006E000-memory.dmp

Filesize
56KB

Download
memory/4648-2-0x0000000002230000-0x000000000224A000-memory.dmp

Filesize
104KB

Download
memory/4648-3-0x0000000004F20000-0x00000000054C4000-memory.dmp

Filesize
5.6MB

Download
memory/4648-4-0x0000000004970000-0x0000000004A02000-memory.dmp

Filesize
584KB

Download
memory/4648-5-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

Filesize
64KB

Download
memory/4648-6-0x0000000004950000-0x000000000495A000-memory.dmp

Filesize
40KB

Download
memory/4648-7-0x000000000B540000-0x000000000B5DC000-memory.dmp

Filesize
624KB

Download
memory/4648-1-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/4648-11-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/4848-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4848-12-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/4848-13-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download
memory/4848-14-0x0000000005190000-0x00000000051F6000-memory.dmp

Filesize
408KB

Download
memory/4848-15-0x0000000006070000-0x00000000060C0000-memory.dmp

Filesize
320KB

Download
memory/4848-16-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/4848-17-0x0000000005010000-0x0000000005020000-memory.dmp

Filesize
64KB

Download