agenttesla | b8d6ff46309ca17651ebe70e1b648b5266b1285b132d1e6894a589c0f852c583

Analysis

max time kernel
142s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 08:48

Target

ORDER_INQUIRY_PDF.exe
Size

236KB
MD5

83e8748124bf874c784ce28d0dcd33f6
SHA1

72006aa1d15993cdaa5790f49acbfea0da3ed726
SHA256

c11bc6cda3987c89debad64d01c2e8d425d809e45db19c46d826f944891c1efe
SHA512

d6ccc82440201f96903e274959c78dbd44f95681294d1a55426063eb2f14fc17c5301171a7b401e5e2e44d19a6cc366372e2275c358832eed52f3aafd0058085
SSDEEP

6144:4du7zrlg25KFpMXp58+DDqFnvhydhcoKQ:frowXDDQ

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6921829812:AAEnJSJNfX1IyXT3BfHBFaRrW9XkEjVZMFs/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
27	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1132 set thread context of 2000	1132	ORDER_INQUIRY_PDF.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	MSBuild.exe
2000	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	ORDER_INQUIRY_PDF.exe
Token: SeDebugPrivilege	2000	MSBuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86
PID 1132 wrote to memory of 2000	1132	ORDER_INQUIRY_PDF.exe	86

memory/1132-7-0x00007FFB32EF0000-0x00007FFB339B1000-memory.dmp

Filesize
10.8MB

Download
memory/1132-1-0x00007FFB32EF3000-0x00007FFB32EF5000-memory.dmp

Filesize
8KB

Download
memory/1132-2-0x00007FFB32EF0000-0x00007FFB339B1000-memory.dmp

Filesize
10.8MB

Download
memory/1132-3-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

Filesize
40KB

Download
memory/1132-0-0x0000000000450000-0x0000000000490000-memory.dmp

Filesize
256KB

Download
memory/2000-6-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/2000-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2000-8-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/2000-9-0x0000000005210000-0x0000000005276000-memory.dmp

Filesize
408KB

Download
memory/2000-10-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download
memory/2000-11-0x0000000006660000-0x00000000066B0000-memory.dmp

Filesize
320KB

Download
memory/2000-12-0x0000000006750000-0x00000000067E2000-memory.dmp

Filesize
584KB

Download
memory/2000-13-0x00000000068F0000-0x00000000068FA000-memory.dmp

Filesize
40KB

Download
memory/2000-14-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/2000-15-0x0000000074D00000-0x00000000754B0000-memory.dmp

Filesize
7.7MB

Download