agenttesla | 0857d1c0085ba3bff25c8b1975846d8ba130c4096e2e4f664ac071b278e42b56

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 08:17

Target

CHEMICAL SPECIFICATIONS.exe
Size

1.0MB
MD5

f564f9251bd76e796906aebb35ae478a
SHA1

e6b87808a2a2b26bcda776e971e442598402b2bd
SHA256

386af47105d3e905ab5c1327fa634dd38e8af6d29f380cfbf0546549734d22f9
SHA512

c979305cd640afe04056d36e327acee49d4c0fa9af77cd7ec9fa6463e7b0c145400be854deda5f8739956cdd95e3bceb44306d16f899487aee53e056f7144308
SSDEEP

24576:9wzV9w070Ln2qfI3F2IJ0mxhyEtWj9gBrZkpsZIjd4bnFdtJB:wV8n2q02IdnyPg1ZyGIjd4bFdtJB

Score

10^/10

Credentials

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 api.ipify.org
20 api.ipify.org
29 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

CHEMICAL SPECIFICATIONS.exe

description pid process target process

PID 3976 set thread context of 1916 3976 CHEMICAL SPECIFICATIONS.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

1916 AddInProcess32.exe
1916 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CHEMICAL SPECIFICATIONS.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 3976 CHEMICAL SPECIFICATIONS.exe
Token: SeDebugPrivilege 1916 AddInProcess32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AddInProcess32.exe

pid process

1916 AddInProcess32.exe

description	pid	process	target process
PID 3976 set thread context of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe

pid	process
1916	AddInProcess32.exe
1916	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	3976	CHEMICAL SPECIFICATIONS.exe
Token: SeDebugPrivilege	1916	AddInProcess32.exe

pid	process
1916	AddInProcess32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

CHEMICAL SPECIFICATIONS.exe

description	pid	process	target process
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1916	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 2432	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 2432	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe
PID 3976 wrote to memory of 2432	3976	CHEMICAL SPECIFICATIONS.exe	AddInProcess32.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:2432

memory/1916-9-0x0000000005860000-0x00000000058C6000-memory.dmp

Filesize
408KB

Download
memory/1916-10-0x0000000006B90000-0x0000000006BE0000-memory.dmp

Filesize
320KB

Download
memory/1916-14-0x0000000005850000-0x0000000005860000-memory.dmp

Filesize
64KB

Download
memory/1916-13-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/1916-4-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1916-5-0x00000000746B0000-0x0000000074E60000-memory.dmp

Filesize
7.7MB

Download
memory/1916-12-0x0000000006C30000-0x0000000006C3A000-memory.dmp

Filesize
40KB

Download
memory/1916-11-0x0000000006C80000-0x0000000006D12000-memory.dmp

Filesize
584KB

Download
memory/1916-6-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/1916-7-0x0000000005850000-0x0000000005860000-memory.dmp

Filesize
64KB

Download
memory/3976-0-0x000001FAB51E0000-0x000001FAB5258000-memory.dmp

Filesize
480KB

Download
memory/3976-8-0x00007FFECBF80000-0x00007FFECCA41000-memory.dmp

Filesize
10.8MB

Download
memory/3976-1-0x00007FFECBF80000-0x00007FFECCA41000-memory.dmp

Filesize
10.8MB

Download
memory/3976-3-0x000001FACF730000-0x000001FACF7CC000-memory.dmp

Filesize
624KB

Download
memory/3976-2-0x000001FAB5660000-0x000001FAB5670000-memory.dmp

Filesize
64KB

Download