agenttesla | 4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:21

Target

4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe
Size

625KB
MD5

0822908fbfcc022427466310b7b3fed9
SHA1

93f3c5538fc46196ecfa6a3c640764cddccb55f8
SHA256

4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806
SHA512

3f159709f418ee54b48fc4b5eea5b23883db9a8a4ff6c6028f452f1b3d48f977a939719f9a7cb37ced763ed7d76525d307b76e2f364a8b7209d28c5be9e93dfd
SSDEEP

12288:nxXykKbChb02qKJliA8Zfq7ZOEGZzdiXaZxtQayJEUanyLz3qbIbLad1:QkpfOfAw3p8KBBnyfqbbH

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6433049610:AAGUidZzrUI9AQcALQrkJj8CAwaWlAMgQYs/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2540	CasPol.exe
2540	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2540	CasPol.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28
PID 2276 wrote to memory of 2540	2276	4dca7ede5929a4df01372e8f3de061b3bc31c787c308173e714e5e9d49486806.exe	28

memory/2276-0-0x0000000073FBE000-0x0000000073FBF000-memory.dmp

Filesize
4KB

Download
memory/2276-1-0x0000000000E90000-0x0000000000F32000-memory.dmp

Filesize
648KB

Download
memory/2276-2-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2276-3-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/2276-4-0x00000000003F0000-0x000000000040A000-memory.dmp

Filesize
104KB

Download
memory/2276-11-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2540-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2540-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2540-10-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-12-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-13-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download