agenttesla | 087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd

Analysis

max time kernel
129s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 03:45

Target

Invoice KIK-1 P234478.exe
Size

1.4MB
MD5

30664b17b297bc3db34968f239360c6f
SHA1

a4185b8ff9e045033d06701e200be57920753754
SHA256

087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd
SHA512

e178dd795f63ddf55ea4abbb9e9b44d493138a1be5b3b3c2928edfd59b8675e0192f223f986230854e1c8855d06041363f6f389d7d20390686e73be16acba0e1
SSDEEP

24576:lsO7OVJ0W//bLLK6tsPdEZ+gqBnf5B1M8We20/ccvLpxBVtra:zixL7Z+gK28/lng

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

29 api.ipify.org
30 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Invoice KIK-1 P234478.exe

description pid process target process

PID 3572 set thread context of 968 3572 Invoice KIK-1 P234478.exe msbuild.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msbuild.exe

pid process

968 msbuild.exe
968 msbuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

msbuild.exe

description pid process

Token: SeDebugPrivilege 968 msbuild.exe

flow	ioc
29	api.ipify.org
30	api.ipify.org

description	pid	process	target process
PID 3572 set thread context of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe

pid	process
968	msbuild.exe
968	msbuild.exe

description	pid	process
Token: SeDebugPrivilege	968	msbuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Invoice KIK-1 P234478.exe

description	pid	process	target process
PID 3572 wrote to memory of 1332	3572	Invoice KIK-1 P234478.exe	regasm.exe
PID 3572 wrote to memory of 1332	3572	Invoice KIK-1 P234478.exe	regasm.exe
PID 3572 wrote to memory of 1332	3572	Invoice KIK-1 P234478.exe	regasm.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 1404	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 1404	3572	Invoice KIK-1 P234478.exe	msbuild.exe
PID 3572 wrote to memory of 1404	3572	Invoice KIK-1 P234478.exe	msbuild.exe

C:\Users\Admin\AppData\Local\Temp\Invoice KIK-1 P234478.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice KIK-1 P234478.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:1332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:1404

memory/968-12-0x0000000006990000-0x0000000006A22000-memory.dmp

Filesize
584KB

Download
memory/968-6-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/968-15-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/968-14-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/968-8-0x0000000005480000-0x00000000054E6000-memory.dmp

Filesize
408KB

Download
memory/968-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/968-13-0x0000000006910000-0x000000000691A000-memory.dmp

Filesize
40KB

Download
memory/968-7-0x0000000005930000-0x0000000005ED4000-memory.dmp

Filesize
5.6MB

Download
memory/968-11-0x00000000068A0000-0x00000000068F0000-memory.dmp

Filesize
320KB

Download
memory/968-9-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/3572-10-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download
memory/3572-4-0x000002C6ED1B0000-0x000002C6ED242000-memory.dmp

Filesize
584KB

Download
memory/3572-0-0x00007FFFEF2C3000-0x00007FFFEF2C5000-memory.dmp

Filesize
8KB

Download
memory/3572-1-0x000002C6ECF00000-0x000002C6ECF0E000-memory.dmp

Filesize
56KB

Download
memory/3572-3-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download
memory/3572-2-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Filesize
10.8MB

Download