agenttesla | 710ebba849b3ce051231c2f0c859b2a6aa0c00ab2a879279a81e6d44f1ccacad

Analysis

max time kernel
148s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PaymentswiftcopyINV00932024.exe
Size 1.0MB
Sample240429-q5s9msca65
SHA256 710ebba849b3ce051231c2f0c859b2a6aa0c00ab2a879279a81e6d44f1ccacad
MD5 c206e8ed7f026afdf97282318a361018
SHA1 642898e055160a573f7c09b897fac22af1a8b141
SHA512 84cd3745b89c97461efea3a7ba7f8482b664a719792701f1d727385614ae46db2877fc72079fcb9fa805f865569f14d3d3f77dbf3b15ea0267832026b814d3cb
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa8erOFsAWdV5:/h+ZkldoPK8Ya8SOFp8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.cmcapama.top
Port
587
Username
[email protected]
Password
EVEitDp@^lu~
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3784 set thread context of 3584	3784	PaymentswiftcopyINV00932024.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3584	RegSvcs.exe
3584	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3784	PaymentswiftcopyINV00932024.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3584	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3784	PaymentswiftcopyINV00932024.exe
3784	PaymentswiftcopyINV00932024.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3784	PaymentswiftcopyINV00932024.exe
3784	PaymentswiftcopyINV00932024.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3584	3784	PaymentswiftcopyINV00932024.exe	87
PID 3784 wrote to memory of 3584	3784	PaymentswiftcopyINV00932024.exe	87
PID 3784 wrote to memory of 3584	3784	PaymentswiftcopyINV00932024.exe	87
PID 3784 wrote to memory of 3584	3784	PaymentswiftcopyINV00932024.exe	87

C:\Users\Admin\AppData\Local\Temp\PaymentswiftcopyINV00932024.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentswiftcopyINV00932024.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\PaymentswiftcopyINV00932024.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3584-11-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3584-12-0x00000000752C0000-0x0000000075A70000-memory.dmp

Download

memory/3584-13-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Download

memory/3584-14-0x00000000055D0000-0x00000000055E0000-memory.dmp

Download

memory/3584-15-0x0000000005650000-0x00000000056B6000-memory.dmp

Download

memory/3584-16-0x00000000063E0000-0x0000000006430000-memory.dmp

Download

memory/3584-17-0x00000000064D0000-0x0000000006562000-memory.dmp

Download

memory/3584-18-0x0000000006470000-0x000000000647A000-memory.dmp

Download

memory/3584-19-0x00000000752C0000-0x0000000075A70000-memory.dmp

Download

memory/3584-20-0x00000000055D0000-0x00000000055E0000-memory.dmp

Download

memory/3784-10-0x0000000000C50000-0x0000000000C54000-memory.dmp

Download