agenttesla | 3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe
Size

1.2MB
MD5

db8d5c5808856045722588e5c2e589fb
SHA1

c5fade4ffc8746ec2837208d101fbfaa194d8de3
SHA256

3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7
SHA512

3a1abee218ddb1686af0610e145c5d12ec8c04abf18619574a262d587ea7ac2b685b61175155375384a429e1653c3b4d409883b4f06810cde963494cd254e97b
SSDEEP

24576:gAHnh+eWsN3skA4RV1Hom2KXMmHapqnbHOhllWwmmwiibl5:Xh+ZkldoPK8YapqbHOrmtiiT

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

25 api.ipify.org
26 api.ipify.org

flow	ioc
25	api.ipify.org
26	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

description	pid	process	target process
PID 1468 set thread context of 3456	1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 1468 WerFault.exe 3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

RegSvcs.exe

pid process

3456 RegSvcs.exe
3456 RegSvcs.exe
3456 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

pid process

1468 3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 3456 RegSvcs.exe

pid	pid_target	process	target process
1740	1468	WerFault.exe	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

pid	process
3456	RegSvcs.exe
3456	RegSvcs.exe
3456	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	3456	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

pid	process
1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe
1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

pid	process
1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe
1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe

description	pid	process	target process
PID 1468 wrote to memory of 3456	1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe	RegSvcs.exe
PID 1468 wrote to memory of 3456	1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe	RegSvcs.exe
PID 1468 wrote to memory of 3456	1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe	RegSvcs.exe
PID 1468 wrote to memory of 3456	1468	3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\3ad7f415aff8f3efddcb3cd80e3755859751565d76df5b15f26c3c243b5330c7_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 736
  2⤵
  - Program crash
  PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1468 -ip 1468
1⤵
PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut4EAC.tmp

Filesize
261KB

MD5
79e22d43eced4dacfefc48ab67a5a026

SHA1
a5480dc5317f802068877c61706380ed5da19ef2

SHA256
ddd75420d3b0ad7963b2610f9da3d0db21092d2df0143468b5291e4cab966d99

SHA512
7d434da3164d23057f75eb3f325b18c1dd952ed3b959fdd61c272aa42589da724153835bfa713f6cf33e703804c4581776149dee1003ecace59f5b0a98148533

Download Submit
memory/1468-12-0x0000000001300000-0x0000000001304000-memory.dmp

Filesize
16KB

Download
memory/3456-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3456-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3456-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3456-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3456-17-0x0000000073B1E000-0x0000000073B1F000-memory.dmp

Filesize
4KB

Download
memory/3456-18-0x0000000002C20000-0x0000000002C74000-memory.dmp

Filesize
336KB

Download
memory/3456-20-0x00000000057E0000-0x0000000005D84000-memory.dmp

Filesize
5.6MB

Download
memory/3456-19-0x0000000073B10000-0x00000000742C0000-memory.dmp

Filesize
7.7MB

Download
memory/3456-21-0x0000000005110000-0x0000000005162000-memory.dmp

Filesize
328KB

Download
memory/3456-31-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-85-0x0000000073B10000-0x00000000742C0000-memory.dmp

Filesize
7.7MB

Download
memory/3456-79-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-77-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-75-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-73-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-71-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-69-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-63-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-61-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-1053-0x0000000005330000-0x0000000005396000-memory.dmp

Filesize
408KB

Download
memory/3456-60-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-1054-0x0000000073B10000-0x00000000742C0000-memory.dmp

Filesize
7.7MB

Download
memory/3456-57-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-55-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-53-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-51-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-49-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-47-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-45-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-43-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-39-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-37-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-35-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-33-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-29-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-27-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-25-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-23-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-22-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-81-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-67-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-65-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-41-0x0000000005110000-0x000000000515D000-memory.dmp

Filesize
308KB

Download
memory/3456-1055-0x0000000006650000-0x00000000066A0000-memory.dmp

Filesize
320KB

Download
memory/3456-1056-0x0000000006740000-0x00000000067D2000-memory.dmp

Filesize
584KB

Download
memory/3456-1057-0x00000000066B0000-0x00000000066BA000-memory.dmp

Filesize
40KB

Download
memory/3456-1058-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3456-1059-0x0000000073B1E000-0x0000000073B1F000-memory.dmp

Filesize
4KB

Download
memory/3456-1060-0x0000000073B10000-0x00000000742C0000-memory.dmp

Filesize
7.7MB

Download