agenttesla | c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe
Size

588KB
MD5

14eb0ebf7cd5e84417b7fc757b36ea82
SHA1

cce3f551be8e39f68c7af147b6d09d4d5e2677e2
SHA256

c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505
SHA512

ec3ccd0e22f060baa6ab4cd30af5693503d889844be763d3da0146069145cb972ebdedcb7a023e889e5d4755e3c8da7ff65d5a2de05b024dfc2c244f0eb98294
SSDEEP

12288:Dg8tD+p1h79i/DdVedE5fJD7uwkQenPIHP/DWKXQ:DgwVDdcE5fJjr0

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot1981857928:AAH1InJNv_BqMV393C_6vOdRVnM6SXDwuJc/sendDocument

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2952-2-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2952-4-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla
behavioral1/memory/2952-6-0x0000000000400000-0x000000000043C000-memory.dmp	family_agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe

description	pid	process	target process
PID 2936 set thread context of 2952	2936	c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

2952 MSBuild.exe
2952 MSBuild.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe

pid process

2936 c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 2952 MSBuild.exe

pid	process
2952	MSBuild.exe
2952	MSBuild.exe

pid	process
2936	c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe

description	pid	process
Token: SeDebugPrivilege	2952	MSBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exeMSBuild.exe

description	pid	process	target process
PID 2936 wrote to memory of 2952	2936	c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe	MSBuild.exe
PID 2936 wrote to memory of 2952	2936	c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe	MSBuild.exe
PID 2936 wrote to memory of 2952	2936	c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe	MSBuild.exe
PID 2936 wrote to memory of 2952	2936	c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe	MSBuild.exe
PID 2936 wrote to memory of 2952	2936	c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe	MSBuild.exe
PID 2952 wrote to memory of 2760	2952	MSBuild.exe	dw20.exe
PID 2952 wrote to memory of 2760	2952	MSBuild.exe	dw20.exe
PID 2952 wrote to memory of 2760	2952	MSBuild.exe	dw20.exe
PID 2952 wrote to memory of 2760	2952	MSBuild.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe
"C:\Users\Admin\AppData\Local\Temp\c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2936

C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
"C:\Users\Admin\AppData\Local\Temp\c7f6f61affdabbd30c62342d684de0fe536ff61c3924a0c36eee3cc640c48505.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 516
3⤵
PID:2760

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-11-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/2936-0-0x00000000010A0000-0x00000000010FF000-memory.dmp

Filesize
380KB

Download
memory/2936-1-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2936-7-0x00000000010A0000-0x00000000010FF000-memory.dmp

Filesize
380KB

Download
memory/2952-2-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2952-4-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2952-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2952-8-0x0000000074710000-0x0000000074CBB000-memory.dmp

Filesize
5.7MB

Download
memory/2952-9-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/2952-10-0x0000000074710000-0x0000000074CBB000-memory.dmp

Filesize
5.7MB

Download
memory/2952-12-0x0000000074710000-0x0000000074CBB000-memory.dmp

Filesize
5.7MB

Download
memory/2952-13-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads