agenttesla | a143da5889aa739a18399bf2d4fe6352191eaa06ed7ef2568dfd57983eaa416a

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RFQ11087.exe
Size

672KB
MD5

1d8c5978c488b34fbbdd7e4f3d004e05
SHA1

78012b122c2005c14fc47074d6dff0b5576bef9d
SHA256

a143da5889aa739a18399bf2d4fe6352191eaa06ed7ef2568dfd57983eaa416a
SHA512

5a319bdb918bf714e88e19527e1aa7f06eb06a3f66938b69e20a338df440cc0fae5f92f4dc2224dd3ddba403f81a5ab58362abe63fa1c6b4e38ec51ab568399e
SSDEEP

12288:urEAmDBPc3B4dcSlcEko2nsCj0CNDtJUy+QzKqWxGf3eb6O0JnWie:krSlcTs+0MULQzKu31zZQ

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.trisquarespl.com
Port:
587
Username:
[email protected]
Password:
uhzJADD6

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.trisquarespl.com
Port:
587
Username:
[email protected]
Password:
uhzJADD6
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 api.ipify.org
21 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ11087.exe

description pid process target process

PID 4768 set thread context of 3656 4768 RFQ11087.exe CasPol.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CasPol.exe

pid process

3656 CasPol.exe
3656 CasPol.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CasPol.exe

description pid process

Token: SeDebugPrivilege 3656 CasPol.exe

flow	ioc
20	api.ipify.org
21	api.ipify.org

description	pid	process	target process
PID 4768 set thread context of 3656	4768	RFQ11087.exe	CasPol.exe

pid	process
3656	CasPol.exe
3656	CasPol.exe

description	pid	process
Token: SeDebugPrivilege	3656	CasPol.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

RFQ11087.exe

description	pid	process	target process
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 3656	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 2768	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 2768	4768	RFQ11087.exe	CasPol.exe
PID 4768 wrote to memory of 2768	4768	RFQ11087.exe	CasPol.exe

C:\Users\Admin\AppData\Local\Temp\RFQ11087.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ11087.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3656-12-0x0000000005650000-0x00000000056B6000-memory.dmp

Filesize
408KB

Download
memory/3656-13-0x0000000006A10000-0x0000000006A60000-memory.dmp

Filesize
320KB

Download
memory/3656-8-0x0000000074FAE000-0x0000000074FAF000-memory.dmp

Filesize
4KB

Download
memory/3656-17-0x0000000074FAE000-0x0000000074FAF000-memory.dmp

Filesize
4KB

Download
memory/3656-16-0x0000000006BB0000-0x0000000006BBA000-memory.dmp

Filesize
40KB

Download
memory/3656-15-0x0000000006C40000-0x0000000006CD2000-memory.dmp

Filesize
584KB

Download
memory/3656-14-0x0000000006B00000-0x0000000006B9C000-memory.dmp

Filesize
624KB

Download
memory/3656-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3656-10-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download
memory/3656-18-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/3656-11-0x0000000074FA0000-0x0000000075750000-memory.dmp

Filesize
7.7MB

Download
memory/4768-2-0x00000249C3DA0000-0x00000249C3E16000-memory.dmp

Filesize
472KB

Download
memory/4768-0-0x00007FFA05EA3000-0x00007FFA05EA5000-memory.dmp

Filesize
8KB

Download
memory/4768-1-0x00000249C2070000-0x00000249C208C000-memory.dmp

Filesize
112KB

Download
memory/4768-6-0x00000249DC4F0000-0x00000249DC584000-memory.dmp

Filesize
592KB

Download
memory/4768-5-0x00000249C2420000-0x00000249C2426000-memory.dmp

Filesize
24KB

Download
memory/4768-4-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download
memory/4768-3-0x00000249C2440000-0x00000249C245E000-memory.dmp

Filesize
120KB

Download
memory/4768-9-0x00007FFA05EA0000-0x00007FFA06961000-memory.dmp

Filesize
10.8MB

Download