agenttesla | 74caca096964cc34ef4132f16a9a0aaa96b2d2a5972ee3c7c55bd5634c88bd70

Analysis

max time kernel
139s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rJlMhHdHP2mDzMGx.exe
Size 1001KB
Sample240419-vvtvmsbb8t
SHA256 74caca096964cc34ef4132f16a9a0aaa96b2d2a5972ee3c7c55bd5634c88bd70
MD5 aa9057494eca3828c4aaca40ec9d823e
SHA1 d40deb9f879f6c5ff7bd8597d95f6c6592861a60
SHA512 ba6d8bb4288e7f3c18c22c58fda0151f5674502c1ff4a19d658eea25ac03404e8ea9805db6446b3d5f806c58b4a46f6a9037b7f3fcda5f26e54815b2b3ece52f
SSDEEP 12288:AhTSy6oFOimegps2Z/FQue7TzPFHKoQjRMecE1Qw31mvlhCtmrZ64991tNGaOVCL:sLh3YvS9PooQqDE1BFmDZ591lYCL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.gazityres.com
Port
587
Username
[email protected]
Password
Gazi1975
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4452 set thread context of 3460	4452	rJlMhHdHP2mDzMGx.exe	95

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
4452	rJlMhHdHP2mDzMGx.exe
3460	MSBuild.exe
3460	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	rJlMhHdHP2mDzMGx.exe
Token: SeDebugPrivilege	3460	MSBuild.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 2152	4452	rJlMhHdHP2mDzMGx.exe	92
PID 4452 wrote to memory of 2152	4452	rJlMhHdHP2mDzMGx.exe	92
PID 4452 wrote to memory of 2152	4452	rJlMhHdHP2mDzMGx.exe	92
PID 4452 wrote to memory of 2448	4452	rJlMhHdHP2mDzMGx.exe	93
PID 4452 wrote to memory of 2448	4452	rJlMhHdHP2mDzMGx.exe	93
PID 4452 wrote to memory of 2448	4452	rJlMhHdHP2mDzMGx.exe	93
PID 4452 wrote to memory of 3656	4452	rJlMhHdHP2mDzMGx.exe	94
PID 4452 wrote to memory of 3656	4452	rJlMhHdHP2mDzMGx.exe	94
PID 4452 wrote to memory of 3656	4452	rJlMhHdHP2mDzMGx.exe	94
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95
PID 4452 wrote to memory of 3460	4452	rJlMhHdHP2mDzMGx.exe	95

C:\Users\Admin\AppData\Local\Temp\rJlMhHdHP2mDzMGx.exe
"C:\Users\Admin\AppData\Local\Temp\rJlMhHdHP2mDzMGx.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3460-13-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3460-21-0x0000000005800000-0x0000000005810000-memory.dmp

Download

memory/3460-20-0x0000000074C00000-0x00000000753B0000-memory.dmp

Download

memory/3460-19-0x0000000006860000-0x00000000068B0000-memory.dmp

Download

memory/3460-18-0x0000000005980000-0x00000000059E6000-memory.dmp

Download

memory/3460-17-0x0000000005800000-0x0000000005810000-memory.dmp

Download

memory/3460-16-0x0000000074C00000-0x00000000753B0000-memory.dmp

Download

memory/4452-5-0x0000000004B50000-0x0000000004B5A000-memory.dmp

Download

memory/4452-15-0x0000000074C00000-0x00000000753B0000-memory.dmp

Download

memory/4452-9-0x00000000050F0000-0x0000000005104000-memory.dmp

Download

memory/4452-10-0x0000000008550000-0x00000000085FE000-memory.dmp

Download

memory/4452-11-0x0000000074C00000-0x00000000753B0000-memory.dmp

Download

memory/4452-12-0x0000000004D60000-0x0000000004D70000-memory.dmp

Download

memory/4452-7-0x0000000005050000-0x0000000005068000-memory.dmp

Download

memory/4452-8-0x00000000050E0000-0x00000000050EE000-memory.dmp

Download

memory/4452-6-0x0000000004E10000-0x0000000004EAC000-memory.dmp

Download

memory/4452-0-0x00000000000A0000-0x00000000001A0000-memory.dmp

Download

memory/4452-4-0x0000000004D60000-0x0000000004D70000-memory.dmp

Download

memory/4452-3-0x0000000004B80000-0x0000000004C12000-memory.dmp

Download

memory/4452-2-0x0000000005130000-0x00000000056D4000-memory.dmp

Download

memory/4452-1-0x0000000074C00000-0x00000000753B0000-memory.dmp

Download