agenttesla | 386af47105d3e905ab5c1327fa634dd38e8af6d29f380cfbf0546549734d22f9

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 08:05

Target

CHEMICAL SPECIFICATIONS.exe
Size

1.0MB
MD5

f564f9251bd76e796906aebb35ae478a
SHA1

e6b87808a2a2b26bcda776e971e442598402b2bd
SHA256

386af47105d3e905ab5c1327fa634dd38e8af6d29f380cfbf0546549734d22f9
SHA512

c979305cd640afe04056d36e327acee49d4c0fa9af77cd7ec9fa6463e7b0c145400be854deda5f8739956cdd95e3bceb44306d16f899487aee53e056f7144308
SSDEEP

24576:9wzV9w070Ln2qfI3F2IJ0mxhyEtWj9gBrZkpsZIjd4bnFdtJB:wV8n2q02IdnyPg1ZyGIjd4bFdtJB

Score

10^/10

Credentials

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

35 api.ipify.org
42 ip-api.com
34 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

CHEMICAL SPECIFICATIONS.exe

description pid process target process

PID 3704 set thread context of 2520 3704 CHEMICAL SPECIFICATIONS.exe installutil.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

installutil.exe

pid process

2520 installutil.exe
2520 installutil.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

CHEMICAL SPECIFICATIONS.exeinstallutil.exe

description pid process

Token: SeDebugPrivilege 3704 CHEMICAL SPECIFICATIONS.exe
Token: SeDebugPrivilege 2520 installutil.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

installutil.exe

pid process

2520 installutil.exe

description	pid	process	target process
PID 3704 set thread context of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe

pid	process
2520	installutil.exe
2520	installutil.exe

description	pid	process
Token: SeDebugPrivilege	3704	CHEMICAL SPECIFICATIONS.exe
Token: SeDebugPrivilege	2520	installutil.exe

pid	process
2520	installutil.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

CHEMICAL SPECIFICATIONS.exe

description	pid	process	target process
PID 3704 wrote to memory of 3524	3704	CHEMICAL SPECIFICATIONS.exe	msbuild.exe
PID 3704 wrote to memory of 3524	3704	CHEMICAL SPECIFICATIONS.exe	msbuild.exe
PID 3704 wrote to memory of 3524	3704	CHEMICAL SPECIFICATIONS.exe	msbuild.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 2520	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 3280	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 3280	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe
PID 3704 wrote to memory of 3280	3704	CHEMICAL SPECIFICATIONS.exe	installutil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
2⤵
PID:3524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
PID:3280

memory/2520-10-0x0000000006B70000-0x0000000006BC0000-memory.dmp

Filesize
320KB

Download
memory/2520-14-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/2520-13-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2520-12-0x0000000006C10000-0x0000000006C1A000-memory.dmp

Filesize
40KB

Download
memory/2520-4-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2520-5-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2520-6-0x0000000005AF0000-0x0000000006094000-memory.dmp

Filesize
5.6MB

Download
memory/2520-7-0x0000000003040000-0x0000000003050000-memory.dmp

Filesize
64KB

Download
memory/2520-8-0x00000000056B0000-0x0000000005716000-memory.dmp

Filesize
408KB

Download
memory/2520-11-0x0000000006C60000-0x0000000006CF2000-memory.dmp

Filesize
584KB

Download
memory/3704-3-0x00000168DC120000-0x00000168DC1BC000-memory.dmp

Filesize
624KB

Download
memory/3704-9-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download
memory/3704-0-0x00000168DA450000-0x00000168DA4C8000-memory.dmp

Filesize
480KB

Download
memory/3704-2-0x00000168F4AC0000-0x00000168F4AD0000-memory.dmp

Filesize
64KB

Download
memory/3704-1-0x00007FFBD4550000-0x00007FFBD5011000-memory.dmp

Filesize
10.8MB

Download