agenttesla | 53c50ffec796c58a62159c70826e1903764ed8c43796900f834fd55f94e13660

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ-HL51L05.exe
Size

1.1MB
MD5

254d0303fffb227dde317b5e2bb664ae
SHA1

f538ce2f5b72eaf0ecfb4a0b4a8af43436c0fb46
SHA256

78fad406a45c2723861ac043560f4fcbe8ff4df4c5e49e702833944af1220e53
SHA512

a9ef2d93e73edeac629d4c927c4e439e9e5b5a67e718edc8e638f7a99bb25745335bf633091dfda02ff6df4b21100106d0f48f4e1882e24ed19294c984213203
SSDEEP

24576:NAHnh+eWsN3skA4RV1Hom2KXMmHa+Lm1ESsb5:sh+ZkldoPK8Ya+6af

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.cmcapama.top
Port:
587
Username:
[email protected]
Password:
EVEitDp@^lu~
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ-HL51L05.exe

description pid process target process

PID 308 set thread context of 312 308 RFQ-HL51L05.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3064 308 WerFault.exe RFQ-HL51L05.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

312 RegSvcs.exe
312 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

RFQ-HL51L05.exe

pid process

308 RFQ-HL51L05.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 312 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

RFQ-HL51L05.exe

pid process

308 RFQ-HL51L05.exe
308 RFQ-HL51L05.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

RFQ-HL51L05.exe

pid process

308 RFQ-HL51L05.exe
308 RFQ-HL51L05.exe

description	pid	process	target process
PID 308 set thread context of 312	308	RFQ-HL51L05.exe	RegSvcs.exe

pid	pid_target	process	target process
3064	308	WerFault.exe	RFQ-HL51L05.exe

pid	process
312	RegSvcs.exe
312	RegSvcs.exe

pid	process
308	RFQ-HL51L05.exe

description	pid	process
Token: SeDebugPrivilege	312	RegSvcs.exe

pid	process
308	RFQ-HL51L05.exe
308	RFQ-HL51L05.exe

pid	process
308	RFQ-HL51L05.exe
308	RFQ-HL51L05.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

RFQ-HL51L05.exe

description	pid	process	target process
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 312	308	RFQ-HL51L05.exe	RegSvcs.exe
PID 308 wrote to memory of 3064	308	RFQ-HL51L05.exe	WerFault.exe
PID 308 wrote to memory of 3064	308	RFQ-HL51L05.exe	WerFault.exe
PID 308 wrote to memory of 3064	308	RFQ-HL51L05.exe	WerFault.exe
PID 308 wrote to memory of 3064	308	RFQ-HL51L05.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ-HL51L05.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-HL51L05.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ-HL51L05.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 316
2⤵
- Program crash
PID:3064

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-10-0x0000000000160000-0x0000000000164000-memory.dmp

Filesize
16KB

Download
memory/312-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/312-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/312-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/312-16-0x0000000073CA0000-0x000000007438E000-memory.dmp

Filesize
6.9MB

Download
memory/312-17-0x0000000073CA0000-0x000000007438E000-memory.dmp

Filesize
6.9MB

Download
memory/312-18-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads