agenttesla | a143da5889aa739a18399bf2d4fe6352191eaa06ed7ef2568dfd57983eaa416a

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ11087.exe
Size

672KB
MD5

1d8c5978c488b34fbbdd7e4f3d004e05
SHA1

78012b122c2005c14fc47074d6dff0b5576bef9d
SHA256

a143da5889aa739a18399bf2d4fe6352191eaa06ed7ef2568dfd57983eaa416a
SHA512

5a319bdb918bf714e88e19527e1aa7f06eb06a3f66938b69e20a338df440cc0fae5f92f4dc2224dd3ddba403f81a5ab58362abe63fa1c6b4e38ec51ab568399e
SSDEEP

12288:urEAmDBPc3B4dcSlcEko2nsCj0CNDtJUy+QzKqWxGf3eb6O0JnWie:krSlcTs+0MULQzKu31zZQ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.trisquarespl.com
Port:
587
Username:
[email protected]
Password:
uhzJADD6
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ11087.exe

description pid process target process

PID 2344 set thread context of 3020 2344 RFQ11087.exe regsvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvcs.exe

pid process

3020 regsvcs.exe
3020 regsvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

regsvcs.exe

description pid process

Token: SeDebugPrivilege 3020 regsvcs.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 2344 set thread context of 3020	2344	RFQ11087.exe	regsvcs.exe

pid	process
3020	regsvcs.exe
3020	regsvcs.exe

description	pid	process
Token: SeDebugPrivilege	3020	regsvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

RFQ11087.exe

description	pid	process	target process
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 3020	2344	RFQ11087.exe	regsvcs.exe
PID 2344 wrote to memory of 2144	2344	RFQ11087.exe	WerFault.exe
PID 2344 wrote to memory of 2144	2344	RFQ11087.exe	WerFault.exe
PID 2344 wrote to memory of 2144	2344	RFQ11087.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\RFQ11087.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ11087.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2344 -s 628
  2⤵
  PID:2144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-0-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Filesize
4KB

Download
memory/2344-1-0x0000000000230000-0x000000000024C000-memory.dmp

Filesize
112KB

Download
memory/2344-2-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Filesize
9.9MB

Download
memory/2344-3-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2344-4-0x000000001AF60000-0x000000001AFF4000-memory.dmp

Filesize
592KB

Download
memory/2344-32-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Filesize
9.9MB

Download
memory/2344-31-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Filesize
4KB

Download
memory/3020-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3020-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-15-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/3020-16-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download
memory/3020-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3020-33-0x000000007406E000-0x000000007406F000-memory.dmp

Filesize
4KB

Download
memory/3020-34-0x0000000074060000-0x000000007474E000-memory.dmp

Filesize
6.9MB

Download