agenttesla | cb65e696842c0650692cde3eaf4b37d1fb5a90b21c89fc2b14d191f06b97d7a3

Analysis

max time kernel
103s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 04:08

Target

b34ae8df913549f1c9f75e813f4febbe.exe
Size

644KB
MD5

b34ae8df913549f1c9f75e813f4febbe
SHA1

ad9e6dbbbcce62b76a2e4d8997f41f00d0516b03
SHA256

cb65e696842c0650692cde3eaf4b37d1fb5a90b21c89fc2b14d191f06b97d7a3
SHA512

45f82b92990ded91fd09c822d6f103048e4dcb4467bd3c5f53d50546e4e6c35769d8e3855e921cbeead1e37899864ff39cf5fc70bf904190125372041c647446
SSDEEP

12288:2VksqBh/3FLJ99PFTI6xfc29DTlNCGGQD3QWoB:2ur/3FLJ7zlNCG9D3QWc

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
16 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

b34ae8df913549f1c9f75e813f4febbe.exe

description pid process target process

PID 2280 set thread context of 2972 2280 b34ae8df913549f1c9f75e813f4febbe.exe regsvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvcs.exe

pid process

2972 regsvcs.exe
2972 regsvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

regsvcs.exe

description pid process

Token: SeDebugPrivilege 2972 regsvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

regsvcs.exe

pid process

2972 regsvcs.exe

flow	ioc
15	api.ipify.org
16	api.ipify.org

description	pid	process	target process
PID 2280 set thread context of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe

pid	process
2972	regsvcs.exe
2972	regsvcs.exe

description	pid	process
Token: SeDebugPrivilege	2972	regsvcs.exe

pid	process
2972	regsvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b34ae8df913549f1c9f75e813f4febbe.exe

description	pid	process	target process
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2972	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2920	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2920	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe
PID 2280 wrote to memory of 2920	2280	b34ae8df913549f1c9f75e813f4febbe.exe	regsvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
2⤵
PID:2920

memory/2280-9-0x00007FFEC3D10000-0x00007FFEC47D1000-memory.dmp

Filesize
10.8MB

Download
memory/2280-1-0x00007FFEC3D10000-0x00007FFEC47D1000-memory.dmp

Filesize
10.8MB

Download
memory/2280-2-0x00000185AFAD0000-0x00000185AFAE0000-memory.dmp

Filesize
64KB

Download
memory/2280-3-0x00000185B0850000-0x00000185B08E6000-memory.dmp

Filesize
600KB

Download
memory/2280-0-0x0000018595470000-0x0000018595482000-memory.dmp

Filesize
72KB

Download
memory/2972-8-0x0000000005770000-0x00000000057D6000-memory.dmp

Filesize
408KB

Download
memory/2972-5-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/2972-7-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download
memory/2972-6-0x0000000005CB0000-0x0000000006254000-memory.dmp

Filesize
5.6MB

Download
memory/2972-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2972-10-0x0000000006A50000-0x0000000006AA0000-memory.dmp

Filesize
320KB

Download
memory/2972-11-0x0000000006B40000-0x0000000006BD2000-memory.dmp

Filesize
584KB

Download
memory/2972-12-0x0000000006CD0000-0x0000000006CDA000-memory.dmp

Filesize
40KB

Download
memory/2972-13-0x0000000074C80000-0x0000000075430000-memory.dmp

Filesize
7.7MB

Download
memory/2972-14-0x00000000056F0000-0x0000000005700000-memory.dmp

Filesize
64KB

Download