agenttesla | 644644cc796d1f18d55a4eccdd95b99497c589e371665c5f2c5e8e782cbc4a22

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 08:17

Target

Payment.exe
Size

1.0MB
MD5

872fc876d25908a93236dcf98e09e3de
SHA1

06da1381d9aaa978ace25c409a59c3d6560975c0
SHA256

a6cd55461ca16e33b153c509417d91eec660cc6d447764c9a312a0ad871ca9c5
SHA512

4f1750c69221ecea05d66a5eb92c2cf821fcc080c3593ac7a3874d7cc9fc8f2ce1d9263329f419cc43188dda09bdbdbb412a5c6bb370aec70a9830588b07d586
SSDEEP

24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaF+CoEFoTiy5:Dh+ZkldoPK8YaF+DH

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 api.ipify.org
17 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Payment.exe

description pid process target process

PID 1636 set thread context of 4688 1636 Payment.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1012 1636 WerFault.exe Payment.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

4688 RegSvcs.exe
4688 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Payment.exe

pid process

1636 Payment.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 4688 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Payment.exe

pid process

1636 Payment.exe
1636 Payment.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Payment.exe

pid process

1636 Payment.exe
1636 Payment.exe

flow	ioc
16	api.ipify.org
17	api.ipify.org

description	pid	process	target process
PID 1636 set thread context of 4688	1636	Payment.exe	RegSvcs.exe

pid	pid_target	process	target process
1012	1636	WerFault.exe	Payment.exe

pid	process
4688	RegSvcs.exe
4688	RegSvcs.exe

pid	process
1636	Payment.exe

description	pid	process
Token: SeDebugPrivilege	4688	RegSvcs.exe

pid	process
1636	Payment.exe
1636	Payment.exe

pid	process
1636	Payment.exe
1636	Payment.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Payment.exe

description	pid	process	target process
PID 1636 wrote to memory of 4688	1636	Payment.exe	RegSvcs.exe
PID 1636 wrote to memory of 4688	1636	Payment.exe	RegSvcs.exe
PID 1636 wrote to memory of 4688	1636	Payment.exe	RegSvcs.exe
PID 1636 wrote to memory of 4688	1636	Payment.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Payment.exe
"C:\Users\Admin\AppData\Local\Temp\Payment.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 696
  2⤵
  - Program crash
  PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1636 -ip 1636
1⤵
PID:3836

memory/1636-10-0x00000000007A0000-0x00000000007A4000-memory.dmp

Filesize
16KB

Download
memory/4688-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4688-12-0x0000000073F00000-0x00000000746B0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-13-0x00000000054F0000-0x0000000005A94000-memory.dmp

Filesize
5.6MB

Download
memory/4688-14-0x0000000005040000-0x00000000050A6000-memory.dmp

Filesize
408KB

Download
memory/4688-15-0x00000000050C0000-0x00000000050D0000-memory.dmp

Filesize
64KB

Download
memory/4688-16-0x0000000006470000-0x00000000064C0000-memory.dmp

Filesize
320KB

Download
memory/4688-17-0x0000000006560000-0x00000000065F2000-memory.dmp

Filesize
584KB

Download
memory/4688-18-0x00000000064E0000-0x00000000064EA000-memory.dmp

Filesize
40KB

Download
memory/4688-19-0x0000000073F00000-0x00000000746B0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-20-0x00000000050C0000-0x00000000050D0000-memory.dmp

Filesize
64KB

Download