agenttesla | 644644cc796d1f18d55a4eccdd95b99497c589e371665c5f2c5e8e782cbc4a22

Analysis

max time kernel
143s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 01:20

Target

Payment.exe
Size

1.0MB
MD5

872fc876d25908a93236dcf98e09e3de
SHA1

06da1381d9aaa978ace25c409a59c3d6560975c0
SHA256

a6cd55461ca16e33b153c509417d91eec660cc6d447764c9a312a0ad871ca9c5
SHA512

4f1750c69221ecea05d66a5eb92c2cf821fcc080c3593ac7a3874d7cc9fc8f2ce1d9263329f419cc43188dda09bdbdbb412a5c6bb370aec70a9830588b07d586
SSDEEP

24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaF+CoEFoTiy5:Dh+ZkldoPK8YaF+DH

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 api.ipify.org
23 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment.exe

description pid process target process

PID 4720 set thread context of 2472 4720 Payment.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1768 4720 WerFault.exe Payment.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2472 RegSvcs.exe
2472 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Payment.exe

pid process

4720 Payment.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2472 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Payment.exe

pid process

4720 Payment.exe
4720 Payment.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Payment.exe

pid process

4720 Payment.exe
4720 Payment.exe

flow	ioc
21	api.ipify.org
23	api.ipify.org

description	pid	process	target process
PID 4720 set thread context of 2472	4720	Payment.exe	RegSvcs.exe

pid	pid_target	process	target process
1768	4720	WerFault.exe	Payment.exe

pid	process
2472	RegSvcs.exe
2472	RegSvcs.exe

pid	process
4720	Payment.exe

description	pid	process
Token: SeDebugPrivilege	2472	RegSvcs.exe

pid	process
4720	Payment.exe
4720	Payment.exe

pid	process
4720	Payment.exe
4720	Payment.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Payment.exe

description	pid	process	target process
PID 4720 wrote to memory of 2472	4720	Payment.exe	RegSvcs.exe
PID 4720 wrote to memory of 2472	4720	Payment.exe	RegSvcs.exe
PID 4720 wrote to memory of 2472	4720	Payment.exe	RegSvcs.exe
PID 4720 wrote to memory of 2472	4720	Payment.exe	RegSvcs.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 696
2⤵
- Program crash
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4720 -ip 4720
1⤵
PID:1604

memory/2472-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2472-12-0x0000000074290000-0x0000000074A40000-memory.dmp

Filesize
7.7MB

Download
memory/2472-13-0x0000000005EA0000-0x0000000006444000-memory.dmp

Filesize
5.6MB

Download
memory/2472-14-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/2472-15-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/2472-16-0x0000000006D10000-0x0000000006D60000-memory.dmp

Filesize
320KB

Download
memory/2472-17-0x0000000006E00000-0x0000000006E92000-memory.dmp

Filesize
584KB

Download
memory/2472-18-0x0000000006D80000-0x0000000006D8A000-memory.dmp

Filesize
40KB

Download
memory/2472-19-0x0000000074290000-0x0000000074A40000-memory.dmp

Filesize
7.7MB

Download
memory/2472-20-0x0000000005880000-0x0000000005890000-memory.dmp

Filesize
64KB

Download
memory/4720-10-0x0000000002050000-0x0000000002054000-memory.dmp

Filesize
16KB

Download