agenttesla | d0e10fccff5a03a83dddff501b9cd9faf10dafdd3b4a479adb48c5a2632b1e33

Resubmissions

18/05/2024, 14:17

240518-rl4fyafe5610

18/05/2024, 13:46

240518-q22rlsec5y10

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe
Size 2.8MB
Sample240518-q22rlsec5y
SHA256 ad80cfe6158ea0c7864c42bcef96848c395f12094c6eecdc15f32ae0cf0a82af
MD5 b3fbe1df64a3b21ff35bbfb01ef4561e
SHA1 ca5e6f05a85f66351f026780ad3573d5091252d3
SHA512 849d1e2f0098b92f2d418603f15300219fde31bf760c1d04b3f3efb4684eb8d9e9c1938dd4dfc74eb1ef6a87027c7540778d95580c56fc68904204605cd8cbf4
SSDEEP 49152:V5fMuz4nO1XaaAx5pHQ+O1SFZQkyH68+3:nBE7ZQkCH+3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.temikan.com.tr
Port
587
Username
[email protected]
Password
temikan63
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	api.ipify.org
17	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3220	installutil.exe
3220	installutil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	installutil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86
PID 900 wrote to memory of 3220	900	PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe	86

C:\Users\Admin\AppData\Local\Temp\PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO N°202415-0004 LUZNAGRA-INDUSTRIA_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3220-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/3220-1-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Download

memory/3220-2-0x0000000005F70000-0x0000000006514000-memory.dmp

Download

memory/3220-3-0x00000000059C0000-0x0000000005A26000-memory.dmp

Download

memory/3220-4-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/3220-5-0x0000000006C70000-0x0000000006CC0000-memory.dmp

Download

memory/3220-6-0x0000000006D60000-0x0000000006DF2000-memory.dmp

Download

memory/3220-7-0x0000000006CE0000-0x0000000006CEA000-memory.dmp

Download

memory/3220-8-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Download

memory/3220-9-0x0000000074D70000-0x0000000075520000-memory.dmp

Download