agenttesla | 2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 01:31

Target

2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe
Size

936KB
MD5

12f0984001a496b1b0ffc2a194c941a3
SHA1

f5be29bdbae4decdb20a60f324fbb9dd3d0934ef
SHA256

2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8
SHA512

b6e83213b59c8e499b8cb97ed75de224b323bbebe8559eb6d6c0d22fc8deef57d76c4a84878e895859260cc605ace2f341faa0b82bc9f4e7ac42c7277b45ed27
SSDEEP

12288:WLwnvLhvEKk5t0QQMl/Dgoc0K3+XTsJ9AsPhS7xeQfpcv6606VbqmI:WLEv1EKk5t1g/DYEAsPs7xe40qm

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6602115092:AAE_EkIum3mOHF88T9ufYt_oJr5nE8bFoJA/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 api.ipify.org
28 api.ipify.org

flow	ioc
27	api.ipify.org
28	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe

description	pid	process	target process
PID 2668 set thread context of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

MSBuild.exe

pid process

4556 MSBuild.exe
4556 MSBuild.exe

pid	process
4556	MSBuild.exe
4556	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe
Token: SeDebugPrivilege	4556	MSBuild.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe

description	pid	process	target process
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe
PID 2668 wrote to memory of 4556	2668	2b438a5f6c0d8a371a194fdb7c57511862fa8569b439a75c8028ef30bbac58d8.exe	MSBuild.exe

memory/2668-6-0x00007FFA58B10000-0x00007FFA595D1000-memory.dmp

Filesize
10.8MB

Download
memory/2668-1-0x00007FFA58B13000-0x00007FFA58B15000-memory.dmp

Filesize
8KB

Download
memory/2668-2-0x00007FFA58B10000-0x00007FFA595D1000-memory.dmp

Filesize
10.8MB

Download
memory/2668-3-0x0000000003060000-0x000000000306A000-memory.dmp

Filesize
40KB

Download
memory/2668-0-0x0000000000EB0000-0x0000000000F9E000-memory.dmp

Filesize
952KB

Download
memory/4556-7-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/4556-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4556-8-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/4556-9-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/4556-10-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download
memory/4556-11-0x0000000006AB0000-0x0000000006B00000-memory.dmp

Filesize
320KB

Download
memory/4556-12-0x0000000006BA0000-0x0000000006C32000-memory.dmp

Filesize
584KB

Download
memory/4556-13-0x0000000006B30000-0x0000000006B3A000-memory.dmp

Filesize
40KB

Download
memory/4556-14-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/4556-15-0x00000000744A0000-0x0000000074C50000-memory.dmp

Filesize
7.7MB

Download