agenttesla | 275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 01:28

Target

275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe
Size

987KB
MD5

5f3daa285dab78f85bdfcb339532ae54
SHA1

c793ebc29ca628d6159f53346615c6b3630f25b6
SHA256

275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1
SHA512

6ab3ac086fdc4511074486067c0ff83ed8da974eeac65bf50f15e17d2d79a2d207ca492d6928df0bbc9741979424202030d37cb1e31f151693f53d0c281f97e7
SSDEEP

24576:/0suND4kgKBoCLtIkSuZFjIzKBzO2Omj2xIY/C2kFL:nFKBoCBHSkjsUOmj2aOC2e

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6678522004:AAFCzMcx9PFLt4zQrKaDiOluS83dl0_buKM/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe

description	pid	process	target process
PID 4804 set thread context of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

installutil.exe

pid process

4428 installutil.exe
4428 installutil.exe

pid	process
4428	installutil.exe
4428	installutil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exeinstallutil.exe

description	pid	process
Token: SeDebugPrivilege	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe
Token: SeDebugPrivilege	4428	installutil.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe

description	pid	process	target process
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 4428	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 852	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 852	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe
PID 4804 wrote to memory of 852	4804	275f57307104db79ff472c9d7dcd5a8dbf31e7f1d09518b7b3979419eef8a7c1.exe	installutil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
PID:852

memory/4428-10-0x0000000006680000-0x00000000066D0000-memory.dmp

Filesize
320KB

Download
memory/4428-14-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/4428-13-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4428-12-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/4428-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4428-6-0x0000000005AD0000-0x0000000006074000-memory.dmp

Filesize
5.6MB

Download
memory/4428-5-0x00000000748A0000-0x0000000075050000-memory.dmp

Filesize
7.7MB

Download
memory/4428-7-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/4428-8-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/4428-11-0x0000000006770000-0x0000000006802000-memory.dmp

Filesize
584KB

Download
memory/4804-3-0x00000220B96C0000-0x00000220B9756000-memory.dmp

Filesize
600KB

Download
memory/4804-9-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download
memory/4804-0-0x00000220B9290000-0x00000220B92F8000-memory.dmp

Filesize
416KB

Download
memory/4804-2-0x00000220B9770000-0x00000220B9780000-memory.dmp

Filesize
64KB

Download
memory/4804-1-0x00007FFE778F0000-0x00007FFE783B1000-memory.dmp

Filesize
10.8MB

Download