agenttesla | 2e546d749c2e13895babd1d2bca41978605c1ba3967ca0b21709646120704760

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SWIFT.exe
Size

671KB
MD5

c3783358a70c67db7ba565a68872b2d6
SHA1

e0c97fdd090069d6fb47589643fad0d8365b537a
SHA256

2e546d749c2e13895babd1d2bca41978605c1ba3967ca0b21709646120704760
SHA512

1290fdf7c8ea57681cc62d27d32f6a2b9b386350cdf883d81f931b01cb19c1a9f38487d58d6f96900406e8dbb2cd0fafb0038e9fd2c003b3dce1c3b5ea1ce229
SSDEEP

12288:Ztlv312Z3YYmvBh+a/UOqfGFE4xyqJaUpzWDAMk3dWlajbrYbCCZM:ZtJ312ZY1v7PxqfYEkvzlMk3AirYmCZ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.quoctoan.vn
Port:
587
Username:
[email protected]
Password:
bGMJNaGYNTLC
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

SWIFT.exe

description pid process target process

PID 4884 set thread context of 4112 4884 SWIFT.exe MSBuild.exe

description	pid	process	target process
PID 4884 set thread context of 4112	4884	SWIFT.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

SWIFT.exeMSBuild.exe

pid	process
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4884	SWIFT.exe
4112	MSBuild.exe
4112	MSBuild.exe
4112	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SWIFT.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 4884 SWIFT.exe
Token: SeDebugPrivilege 4112 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	4884	SWIFT.exe
Token: SeDebugPrivilege	4112	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

SWIFT.exe

description	pid	process	target process
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe
PID 4884 wrote to memory of 4112	4884	SWIFT.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\SWIFT.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4112-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4112-20-0x0000000005330000-0x0000000005340000-memory.dmp

Filesize
64KB

Download
memory/4112-19-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4112-18-0x0000000006120000-0x0000000006170000-memory.dmp

Filesize
320KB

Download
memory/4112-17-0x0000000005330000-0x0000000005340000-memory.dmp

Filesize
64KB

Download
memory/4112-15-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/4112-16-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4884-5-0x00000000054F0000-0x00000000054FA000-memory.dmp

Filesize
40KB

Download
memory/4884-8-0x00000000086D0000-0x0000000008754000-memory.dmp

Filesize
528KB

Download
memory/4884-9-0x000000000BC80000-0x000000000BD1C000-memory.dmp

Filesize
624KB

Download
memory/4884-10-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4884-11-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/4884-7-0x0000000005760000-0x0000000005774000-memory.dmp

Filesize
80KB

Download
memory/4884-14-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/4884-6-0x0000000005620000-0x0000000005640000-memory.dmp

Filesize
128KB

Download
memory/4884-0-0x0000000000A60000-0x0000000000B0E000-memory.dmp

Filesize
696KB

Download
memory/4884-4-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/4884-3-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/4884-2-0x0000000005AC0000-0x0000000006064000-memory.dmp

Filesize
5.6MB

Download
memory/4884-1-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download