agenttesla | 22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe
Size

1010KB
MD5

a7ba425ea1437fbcf79e9cd2dea16aa4
SHA1

285a5347bd6f6eb80ad853321e17da16ed6260f8
SHA256

22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf
SHA512

0d3bfef1f4aee59f265c78207a85452c648ced99ab4698abd8c9558ca0f6e5b226b7950673992a44dc7fafb70f683976db47fdf53c96e3c586bd29d5c7109cbe
SSDEEP

24576:OAHnh+eWsN3skA4RV1Hom2KXMmHazJElTax8K5:5h+ZkldoPK8YazJpT

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.elquijotebanquetes.com
Port:
21
Username:
[email protected]
Password:
4r@d15PS!-!h

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

35 ip-api.com

flow	ioc
35	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

description	pid	process	target process
PID 908 set thread context of 2800	908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5040 908 WerFault.exe 22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2800 RegSvcs.exe
2800 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

pid process

908 22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2800 RegSvcs.exe

pid	pid_target	process	target process
5040	908	WerFault.exe	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

pid	process
2800	RegSvcs.exe
2800	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2800	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

pid	process
908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe
908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

pid	process
908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe
908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe

description	pid	process	target process
PID 908 wrote to memory of 2800	908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe	RegSvcs.exe
PID 908 wrote to memory of 2800	908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe	RegSvcs.exe
PID 908 wrote to memory of 2800	908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe	RegSvcs.exe
PID 908 wrote to memory of 2800	908	22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe
"C:\Users\Admin\AppData\Local\Temp\22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\22d02c9746e250a2a792a5a7a64e3147deeb2f88ad76a1c3a3fc47d0d5faf6cf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 704
2⤵
- Program crash
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 908 -ip 908
1⤵
PID:2260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-10-0x0000000001290000-0x0000000001294000-memory.dmp

Filesize
16KB

Download
memory/2800-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2800-13-0x00000000057F0000-0x0000000005D94000-memory.dmp

Filesize
5.6MB

Download
memory/2800-14-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/2800-15-0x00000000052B0000-0x0000000005316000-memory.dmp

Filesize
408KB

Download
memory/2800-12-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/2800-16-0x0000000006540000-0x0000000006590000-memory.dmp

Filesize
320KB

Download
memory/2800-17-0x0000000006630000-0x00000000066C2000-memory.dmp

Filesize
584KB

Download
memory/2800-18-0x00000000065C0000-0x00000000065CA000-memory.dmp

Filesize
40KB

Download
memory/2800-19-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/2800-20-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download