agenttesla | b7f8e5d5eb84ea1419064f1d85b0e6570f9fb2b9cbc5eb72b11e463a3d7e6314

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Your file name without extension goes here.exe
Size 1.4MB
Sample240521-ea4aksgd47
SHA256 b7f8e5d5eb84ea1419064f1d85b0e6570f9fb2b9cbc5eb72b11e463a3d7e6314
MD5 9fbf1890e0236da00be34bab1b6979c9
SHA1 4d9f66bdc24dda4355870001a1e25494bb0e411c
SHA512 bf827a0c4019af1aa565a82f747872bd014159dcc73fd8d76b08051026ff997b41797279544b78b2e5434fb3cd3d72405188274bb145a57a293d7051f459796e
SSDEEP 24576:OUzKsG5DaqdRk6JSpu1Ho6tsPqXz+ULhOxJ/NDCB32mJ+sz+D8yKnSk6Y8anr/:fr01nz+Ucf/UB3PJ+sKgyKQrar/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
terminal4.veeblehosting.com
Port
587
Username
[email protected]
Password
Ifeanyi1987@
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2432 set thread context of 4612	2432	Your file name without extension goes here.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4612	msbuild.exe
4612	msbuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4612	msbuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4612	2432	Your file name without extension goes here.exe	92
PID 2432 wrote to memory of 4372	2432	Your file name without extension goes here.exe	93
PID 2432 wrote to memory of 4372	2432	Your file name without extension goes here.exe	93
PID 2432 wrote to memory of 4372	2432	Your file name without extension goes here.exe	93

C:\Users\Admin\AppData\Local\Temp\Your file name without extension goes here.exe
"C:\Users\Admin\AppData\Local\Temp\Your file name without extension goes here.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:4372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x00007FFFF3A33000-0x00007FFFF3A35000-memory.dmp

Download

memory/2432-1-0x000001E64BB00000-0x000001E64BB10000-memory.dmp

Download

memory/2432-2-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp

Download

memory/2432-3-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp

Download

memory/2432-4-0x000001E664570000-0x000001E664604000-memory.dmp

Download

memory/2432-10-0x00007FFFF3A30000-0x00007FFFF44F1000-memory.dmp

Download

memory/4612-8-0x0000000005050000-0x00000000050B6000-memory.dmp

Download

memory/4612-7-0x0000000005690000-0x0000000005C34000-memory.dmp

Download

memory/4612-6-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/4612-9-0x0000000074D40000-0x00000000754F0000-memory.dmp

Download

memory/4612-5-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4612-11-0x0000000006480000-0x00000000064D0000-memory.dmp

Download

memory/4612-12-0x0000000006570000-0x0000000006602000-memory.dmp

Download

memory/4612-13-0x0000000006510000-0x000000000651A000-memory.dmp

Download

memory/4612-14-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/4612-15-0x0000000074D40000-0x00000000754F0000-memory.dmp

Download