agenttesla | 087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd

Analysis

max time kernel
129s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice KIK-1 P234478.exe
Size 1.4MB
Sample240521-ea4lcagd48
SHA256 087f3c379a1f08fc51ba599872013c25ee442d1bfeb87ce93503239ea2a388fd
MD5 30664b17b297bc3db34968f239360c6f
SHA1 a4185b8ff9e045033d06701e200be57920753754
SHA512 e178dd795f63ddf55ea4abbb9e9b44d493138a1be5b3b3c2928edfd59b8675e0192f223f986230854e1c8855d06041363f6f389d7d20390686e73be16acba0e1
SSDEEP 24576:lsO7OVJ0W//bLLK6tsPdEZ+gqBnf5B1M8We20/ccvLpxBVtra:zixL7Z+gK28/lng
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.trisquarespl.com
Port
587
Username
[email protected]
Password
uhzJADD6
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	api.ipify.org
30	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3572 set thread context of 968	3572	Invoice KIK-1 P234478.exe	95

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
968	msbuild.exe
968	msbuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	msbuild.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1332	3572	Invoice KIK-1 P234478.exe	93
PID 3572 wrote to memory of 1332	3572	Invoice KIK-1 P234478.exe	93
PID 3572 wrote to memory of 1332	3572	Invoice KIK-1 P234478.exe	93
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 968	3572	Invoice KIK-1 P234478.exe	95
PID 3572 wrote to memory of 1404	3572	Invoice KIK-1 P234478.exe	96
PID 3572 wrote to memory of 1404	3572	Invoice KIK-1 P234478.exe	96
PID 3572 wrote to memory of 1404	3572	Invoice KIK-1 P234478.exe	96

C:\Users\Admin\AppData\Local\Temp\Invoice KIK-1 P234478.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice KIK-1 P234478.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:1332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-12-0x0000000006990000-0x0000000006A22000-memory.dmp

Download

memory/968-11-0x00000000068A0000-0x00000000068F0000-memory.dmp

Download

memory/968-15-0x0000000074B20000-0x00000000752D0000-memory.dmp

Download

memory/968-14-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Download

memory/968-6-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Download

memory/968-5-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/968-13-0x0000000006910000-0x000000000691A000-memory.dmp

Download

memory/968-9-0x0000000074B20000-0x00000000752D0000-memory.dmp

Download

memory/968-8-0x0000000005480000-0x00000000054E6000-memory.dmp

Download

memory/968-7-0x0000000005930000-0x0000000005ED4000-memory.dmp

Download

memory/3572-4-0x000002C6ED1B0000-0x000002C6ED242000-memory.dmp

Download

memory/3572-10-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Download

memory/3572-0-0x00007FFFEF2C3000-0x00007FFFEF2C5000-memory.dmp

Download

memory/3572-1-0x000002C6ECF00000-0x000002C6ECF0E000-memory.dmp

Download

memory/3572-3-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Download

memory/3572-2-0x00007FFFEF2C0000-0x00007FFFEFD81000-memory.dmp

Download