agenttesla | b1969e370f6e1b45c7c94605b4d195c1291b517edefb41f914523b2846bcd1c6

Analysis

max time kernel
98s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PROJECT.exe
Size

780KB
MD5

977177ff7930860f4f208ebe1fc68675
SHA1

44712ca7daad4e129d83ff0e9451643fe4605a90
SHA256

029a6006153d100f8f27e550b7f682e49d4c3aa52b80039d5f06e8abd4d398be
SHA512

347d50576b78e08ea0931467dd6d1acdb6e63dd0fc7f1f3718bf6cb8ddc023fefdfcc619682816c1ba835e377dad4162a24dc34e22e17de53118a4190c9b2e71
SSDEEP

12288:6I+5G8cPtP8sdE0rm1OkKCJLc/Y9ysnqY0Fsiu0NQMlmNnT/RpXAlTnkw7BjZ5QY:c8P8sVrKOkrggWFsfTJpwlTkm/Q

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.vila-gabriel.ro
Port:
21
Username:
[email protected]
Password:
bVkMH6R.pfF~NN@ossy$W!_pz[bh!9l(MU%UtX9L^W}vO=mn*g*;]}]

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.vila-gabriel.ro
Port:
21
Username:
[email protected]
Password:
bVkMH6R.pfF~NN@ossy$W!_pz[bh!9l(MU%UtX9L^W}vO=mn*g*;]}]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

PROJECT.exe

description pid process target process

PID 2240 set thread context of 4984 2240 PROJECT.exe PROJECT.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PROJECT.exePROJECT.exe

pid process

2240 PROJECT.exe
2240 PROJECT.exe
4984 PROJECT.exe
4984 PROJECT.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PROJECT.exePROJECT.exe

description pid process

Token: SeDebugPrivilege 2240 PROJECT.exe
Token: SeDebugPrivilege 4984 PROJECT.exe

description	pid	process	target process
PID 2240 set thread context of 4984	2240	PROJECT.exe	PROJECT.exe

pid	process
2240	PROJECT.exe
2240	PROJECT.exe
4984	PROJECT.exe
4984	PROJECT.exe

description	pid	process
Token: SeDebugPrivilege	2240	PROJECT.exe
Token: SeDebugPrivilege	4984	PROJECT.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

PROJECT.exe

description	pid	process	target process
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe
PID 2240 wrote to memory of 4984	2240	PROJECT.exe	PROJECT.exe

C:\Users\Admin\AppData\Local\Temp\PROJECT.exe
"C:\Users\Admin\AppData\Local\Temp\PROJECT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240

C:\Users\Admin\AppData\Local\Temp\PROJECT.exe
"C:\Users\Admin\AppData\Local\Temp\PROJECT.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2240-10-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/2240-2-0x00000000058E0000-0x000000000597C000-memory.dmp

Filesize
624KB

Download
memory/2240-11-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/2240-3-0x0000000005F30000-0x00000000064D4000-memory.dmp

Filesize
5.6MB

Download
memory/2240-4-0x0000000005A20000-0x0000000005AB2000-memory.dmp

Filesize
584KB

Download
memory/2240-5-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/2240-6-0x0000000006BB0000-0x0000000006BF4000-memory.dmp

Filesize
272KB

Download
memory/2240-7-0x0000000006D40000-0x0000000006D4A000-memory.dmp

Filesize
40KB

Download
memory/2240-12-0x0000000008140000-0x000000000815A000-memory.dmp

Filesize
104KB

Download
memory/2240-9-0x0000000005C60000-0x0000000005C70000-memory.dmp

Filesize
64KB

Download
memory/2240-0-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/2240-1-0x0000000000E90000-0x0000000000F5A000-memory.dmp

Filesize
808KB

Download
memory/2240-8-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/2240-13-0x0000000007F80000-0x0000000007F86000-memory.dmp

Filesize
24KB

Download
memory/2240-18-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/4984-15-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/4984-16-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/4984-14-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4984-19-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/4984-20-0x0000000006330000-0x0000000006380000-memory.dmp

Filesize
320KB

Download
memory/4984-21-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/4984-22-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download