agenttesla | 5cefeec91fba3d10f09757957852615247443e53f670da3c2af2c3c8aae068d5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swift copy.exe
Size 682KB
Sample240502-lwl2rage38
SHA256 5cefeec91fba3d10f09757957852615247443e53f670da3c2af2c3c8aae068d5
MD5 4667e620dff69d721062bb866b5e38c4
SHA1 2773de0cba8f1c513b3b6358d6a394210652ad47
SHA512 48aacd17b15f25305145ac7fb8fe7c677bf12de6caf081f6463bf185336ec9cd8356443027c1f016d2889d989a70626aab4f9bf13b7dfb5d8ee58b2afd57241d
SSDEEP 12288:13/T3/fVrTtK3/qa6uREPb/Zn06Q9O4P+g+JeG8TGif0xxFGVzW2lALToqfh6n48:1rXVrTtKV69JlmP+g+JeVGifuFGVzVl9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.ucj.ac.lk
Port
587
Username
[email protected]
Password
Hiro@6898hk
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 2688	2036	swift copy.exe	29

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2036	swift copy.exe
2688	MSBuild.exe
2688	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	swift copy.exe
Token: SeDebugPrivilege	2688	MSBuild.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2448	2036	swift copy.exe	28
PID 2036 wrote to memory of 2448	2036	swift copy.exe	28
PID 2036 wrote to memory of 2448	2036	swift copy.exe	28
PID 2036 wrote to memory of 2448	2036	swift copy.exe	28
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29
PID 2036 wrote to memory of 2688	2036	swift copy.exe	29

C:\Users\Admin\AppData\Local\Temp\swift copy.exe
"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x000000007495E000-0x000000007495F000-memory.dmp

Download

memory/2036-1-0x0000000000220000-0x00000000002D0000-memory.dmp

Download

memory/2036-2-0x0000000000590000-0x00000000005A6000-memory.dmp

Download

memory/2036-3-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/2036-4-0x0000000001D40000-0x0000000001D56000-memory.dmp

Download

memory/2036-5-0x0000000005130000-0x00000000051B2000-memory.dmp

Download

memory/2036-6-0x000000007495E000-0x000000007495F000-memory.dmp

Download

memory/2036-7-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/2036-19-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/2688-13-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2688-9-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2688-17-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2688-15-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2688-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Download

memory/2688-11-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2688-10-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2688-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2688-18-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/2688-20-0x0000000074950000-0x000000007503E000-memory.dmp

Download

memory/2688-21-0x0000000074950000-0x000000007503E000-memory.dmp

Download