agenttesla | 1ad2e5df626723bca2bf7ac89733392b1a44849e1345e90f3cc6d3d034873bd4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

z1PO.exe
Size

208KB
MD5

10b76ce4a151fb9a87c756ddacae357f
SHA1

d86ad648734ea7c5372819f9bcec5411b02d6358
SHA256

1ad2e5df626723bca2bf7ac89733392b1a44849e1345e90f3cc6d3d034873bd4
SHA512

3969e20675af8d718963b7712435922e7697e85c1e1560520d0ba99bc456f1fdf50390a05f980216ed82095c5f6ed169226abc4ffb18f8c584dc8c7dc6326264
SSDEEP

3072:LY5Z0ub84cpaiToaOcJ+GMK/ThXQsIZeUdUsIH4UtwaGpefC7GmCMY7pdkW:OTOEiscJ+GMKL6sITUsIH4wGpQ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://80.92.205.47
Port:
21
Username:
delizzasuppl
Password:
99EK7bvTZr4zBnwW

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

z1PO.exe

description pid process target process

PID 2188 set thread context of 2092 2188 z1PO.exe Caspol.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Caspol.exe

pid process

2092 Caspol.exe
2092 Caspol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Caspol.exe

description pid process

Token: SeDebugPrivilege 2092 Caspol.exe

flow	ioc
4	ip-api.com

description	pid	process	target process
PID 2188 set thread context of 2092	2188	z1PO.exe	Caspol.exe

pid	process
2092	Caspol.exe
2092	Caspol.exe

description	pid	process
Token: SeDebugPrivilege	2092	Caspol.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

z1PO.exe

description	pid	process	target process
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe
PID 2188 wrote to memory of 2092	2188	z1PO.exe	Caspol.exe

C:\Users\Admin\AppData\Local\Temp\z1PO.exe
"C:\Users\Admin\AppData\Local\Temp\z1PO.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2092-17-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-18-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2092-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2092-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-10-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2092-22-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/2092-21-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2092-19-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/2092-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2188-0-0x0000000000810000-0x000000000084A000-memory.dmp

Filesize
232KB

Download
memory/2188-1-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-3-0x00000000004B0000-0x00000000004DE000-memory.dmp

Filesize
184KB

Download
memory/2188-20-0x0000000074390000-0x0000000074A7E000-memory.dmp

Filesize
6.9MB

Download
memory/2188-2-0x0000000004980000-0x00000000049C0000-memory.dmp

Filesize
256KB

Download
memory/2188-4-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download