agenttesla | 9c49bbe71a875101949fd0ddf980825c8ac09d566c9e55c2ac94caf8052f5e2e

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PRODUCTS LIST.pdf.exe
Size

725KB
MD5

3afc031f6c1a6ec6d4d075351c16529b
SHA1

25b3288e34d9b6473572d2f4264c27546700faa6
SHA256

9c49bbe71a875101949fd0ddf980825c8ac09d566c9e55c2ac94caf8052f5e2e
SHA512

102c95629b14ba98256f56d14a6418a5f0bb79b562d129b948fdafd1b0d29ade909c1cdc5d0854460ba6ccf240e3be763d9b038cdd735a7c28cb5213be1b7556
SSDEEP

12288:U4CMwY4XU5F5gIKxGA87K5BV5lwKSj6bthuaLlsXaeyXYAlRzFIhuaOaT1upA7kR:li0Fm4IBV5vtUa+bLAlR5IhV1i

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.animetals.com.my
Port:
587
Username:
[email protected]
Password:
8VHMY#KF%kpF
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
6 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

PRODUCTS LIST.pdf.exe

description pid process target process

PID 2212 set thread context of 2304 2212 PRODUCTS LIST.pdf.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PRODUCTS LIST.pdf.exeRegSvcs.exe

pid process

2212 PRODUCTS LIST.pdf.exe
2212 PRODUCTS LIST.pdf.exe
2304 RegSvcs.exe
2304 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PRODUCTS LIST.pdf.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2212 PRODUCTS LIST.pdf.exe
Token: SeDebugPrivilege 2304 RegSvcs.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip-api.com

description	pid	process	target process
PID 2212 set thread context of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe

pid	process
2212	PRODUCTS LIST.pdf.exe
2212	PRODUCTS LIST.pdf.exe
2304	RegSvcs.exe
2304	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2212	PRODUCTS LIST.pdf.exe
Token: SeDebugPrivilege	2304	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

PRODUCTS LIST.pdf.exe

description	pid	process	target process
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe
PID 2212 wrote to memory of 2304	2212	PRODUCTS LIST.pdf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PRODUCTS LIST.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-0-0x00000000011F0000-0x00000000012A6000-memory.dmp

Filesize
728KB

Download
memory/2212-1-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2212-2-0x00000000010F0000-0x0000000001130000-memory.dmp

Filesize
256KB

Download
memory/2212-3-0x00000000004B0000-0x00000000004C2000-memory.dmp

Filesize
72KB

Download
memory/2212-4-0x00000000004D0000-0x00000000004DC000-memory.dmp

Filesize
48KB

Download
memory/2212-5-0x0000000004FF0000-0x0000000005074000-memory.dmp

Filesize
528KB

Download
memory/2212-17-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2304-8-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2304-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2304-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2304-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2304-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2304-12-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2304-16-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2304-18-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2304-6-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2304-19-0x0000000004AF0000-0x0000000004B30000-memory.dmp

Filesize
256KB

Download
memory/2304-20-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download