agenttesla | cb65e696842c0650692cde3eaf4b37d1fb5a90b21c89fc2b14d191f06b97d7a3

Analysis

max time kernel
103s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 04:08

Target

b34ae8df913549f1c9f75e813f4febbe.exe
Size

644KB
MD5

b34ae8df913549f1c9f75e813f4febbe
SHA1

ad9e6dbbbcce62b76a2e4d8997f41f00d0516b03
SHA256

cb65e696842c0650692cde3eaf4b37d1fb5a90b21c89fc2b14d191f06b97d7a3
SHA512

45f82b92990ded91fd09c822d6f103048e4dcb4467bd3c5f53d50546e4e6c35769d8e3855e921cbeead1e37899864ff39cf5fc70bf904190125372041c647446
SSDEEP

12288:2VksqBh/3FLJ99PFTI6xfc29DTlNCGGQD3QWoB:2ur/3FLJ7zlNCG9D3QWc

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org
16	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2280 set thread context of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	regsvcs.exe
2972	regsvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	regsvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2972	regsvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	85
PID 2280 wrote to memory of 2920	2280	b34ae8df913549f1c9f75e813f4febbe.exe	86
PID 2280 wrote to memory of 2920	2280	b34ae8df913549f1c9f75e813f4febbe.exe	86
PID 2280 wrote to memory of 2920	2280	b34ae8df913549f1c9f75e813f4febbe.exe	86

C:\Users\Admin\AppData\Local\Temp\b34ae8df913549f1c9f75e813f4febbe.exe
"C:\Users\Admin\AppData\Local\Temp\b34ae8df913549f1c9f75e813f4febbe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  PID:2920

memory/2280-9-0x00007FFEC3D10000-0x00007FFEC47D1000-memory.dmp

Filesize
10.8MB

Download
memory/2280-1-0x00007FFEC3D10000-0x00007FFEC47D1000-memory.dmp

Filesize
10.8MB

Download
memory/2280-2-0x00000185AFAD0000-0x00000185AFAE0000-memory.dmp

Filesize
64KB

Download
memory/2280-3-0x00000185B0850000-0x00000185B08E6000-memory.dmp

Filesize
600KB

Download
memory/2280-0-0x0000018595470000-0x0000018595482000-memory.dmp

Filesize
72KB

Download
memory/2972-8-0x0000000005770000-0x00000000057D6000-memory.dmp

Filesize
408KB

Download
memory/2972-5-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/2972-7-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download
memory/2972-6-0x0000000005CB0000-0x0000000006254000-memory.dmp

Filesize
5.6MB

Download
memory/2972-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2972-10-0x0000000006A50000-0x0000000006AA0000-memory.dmp

Filesize
320KB

Download
memory/2972-11-0x0000000006B40000-0x0000000006BD2000-memory.dmp

Filesize
584KB

Download
memory/2972-12-0x0000000006CD0000-0x0000000006CDA000-memory.dmp

Filesize
40KB

Download
memory/2972-13-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/2972-14-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download