agenttesla | 644644cc796d1f18d55a4eccdd95b99497c589e371665c5f2c5e8e782cbc4a22

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 08:17

Target

Payment.exe
Size

1.0MB
MD5

872fc876d25908a93236dcf98e09e3de
SHA1

06da1381d9aaa978ace25c409a59c3d6560975c0
SHA256

a6cd55461ca16e33b153c509417d91eec660cc6d447764c9a312a0ad871ca9c5
SHA512

4f1750c69221ecea05d66a5eb92c2cf821fcc080c3593ac7a3874d7cc9fc8f2ce1d9263329f419cc43188dda09bdbdbb412a5c6bb370aec70a9830588b07d586
SSDEEP

24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaF+CoEFoTiy5:Dh+ZkldoPK8YaF+DH

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment.exe

description pid process target process

PID 1368 set thread context of 2164 1368 Payment.exe RegSvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2164 RegSvcs.exe
2164 RegSvcs.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Payment.exe

pid process

1368 Payment.exe
1368 Payment.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2164 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Payment.exe

pid process

1368 Payment.exe
1368 Payment.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Payment.exe

pid process

1368 Payment.exe
1368 Payment.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 1368 set thread context of 2164	1368	Payment.exe	RegSvcs.exe

pid	process
2164	RegSvcs.exe
2164	RegSvcs.exe

pid	process
1368	Payment.exe
1368	Payment.exe

description	pid	process
Token: SeDebugPrivilege	2164	RegSvcs.exe

pid	process
1368	Payment.exe
1368	Payment.exe

pid	process
1368	Payment.exe
1368	Payment.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Payment.exe

description	pid	process	target process
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe
PID 1368 wrote to memory of 2164	1368	Payment.exe	RegSvcs.exe

memory/1368-10-0x00000000002F0000-0x00000000002F4000-memory.dmp

Filesize
16KB

Download
memory/2164-11-0x0000000000090000-0x00000000000D0000-memory.dmp

Filesize
256KB

Download
memory/2164-13-0x0000000000090000-0x00000000000D0000-memory.dmp

Filesize
256KB

Download
memory/2164-17-0x0000000000090000-0x00000000000D0000-memory.dmp

Filesize
256KB

Download
memory/2164-20-0x0000000000090000-0x00000000000D0000-memory.dmp

Filesize
256KB

Download
memory/2164-21-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-22-0x0000000004A30000-0x0000000004A70000-memory.dmp

Filesize
256KB

Download
memory/2164-23-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2164-24-0x0000000004A30000-0x0000000004A70000-memory.dmp

Filesize
256KB

Download