agenttesla | cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d

Analysis

max time kernel
66s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29-04-2024 09:27

Target

Document Copy_pdf.exe
Size

884KB
MD5

f75f9606f6aeb72bf28ecd1419542d7d
SHA1

bc7eca6ece5ace34b990e8782dbe1782c33ea91b
SHA256

cacccbfd0c9975dbca0b686f166c1fac1a144cd379937ee1a0aa66183c83601d
SHA512

25cf388cbf234948055f5096010615745b92a6aea28328910dde72a13fdfc7f0a580f2e6b9b0544875a985da83f41a2fe04c7dd36eb687095a768ef31c1dd64f
SSDEEP

24576:L0jj5VRQElW+B50gZuzTt/MDFdws7Sfn/eBGhW3:bElW+B53ZuPBaF2X7hW3

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Document Copy_pdf.exe

description pid process target process

PID 3976 set thread context of 1488 3976 Document Copy_pdf.exe AddInProcess32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

752 1488 WerFault.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

1488 AddInProcess32.exe
1488 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Document Copy_pdf.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 3976 Document Copy_pdf.exe
Token: SeDebugPrivilege 1488 AddInProcess32.exe

flow	ioc
4	api.ipify.org

description	pid	process	target process
PID 3976 set thread context of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe

pid	pid_target	process	target process
752	1488	WerFault.exe	AddInProcess32.exe

pid	process
1488	AddInProcess32.exe
1488	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	3976	Document Copy_pdf.exe
Token: SeDebugPrivilege	1488	AddInProcess32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Document Copy_pdf.exe

description	pid	process	target process
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 1488	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 2820	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 2820	3976	Document Copy_pdf.exe	AddInProcess32.exe
PID 3976 wrote to memory of 2820	3976	Document Copy_pdf.exe	AddInProcess32.exe

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 1808
3⤵
- Program crash
PID:752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1488 -ip 1488
1⤵
PID:3500

memory/1488-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1488-5-0x0000000074FC0000-0x0000000075770000-memory.dmp

Filesize
7.7MB

Download
memory/1488-6-0x0000000005EF0000-0x0000000006494000-memory.dmp

Filesize
5.6MB

Download
memory/1488-7-0x0000000005930000-0x0000000005940000-memory.dmp

Filesize
64KB

Download
memory/1488-8-0x0000000005830000-0x0000000005896000-memory.dmp

Filesize
408KB

Download
memory/1488-10-0x0000000074FC0000-0x0000000075770000-memory.dmp

Filesize
7.7MB

Download
memory/3976-0-0x0000015F63F50000-0x0000015F63FA0000-memory.dmp

Filesize
320KB

Download
memory/3976-1-0x00007FFDBC0B0000-0x00007FFDBCB71000-memory.dmp

Filesize
10.8MB

Download
memory/3976-2-0x0000015F7E550000-0x0000015F7E560000-memory.dmp

Filesize
64KB

Download
memory/3976-3-0x0000015F7E3B0000-0x0000015F7E446000-memory.dmp

Filesize
600KB

Download
memory/3976-9-0x00007FFDBC0B0000-0x00007FFDBCB71000-memory.dmp

Filesize
10.8MB

Download