agenttesla | 8c105456ff94dd246a43b2954996673e244c733d3fb31404237f3b2ff17b7a55

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:15

Target

BirikimOzeti.pdf.exe
Size

2.5MB
MD5

7a8ade6c609d2f731d49edcbea8a4460
SHA1

db3c54e7561245ab9865c28489b1e7a1a16ba68b
SHA256

d353138e99ad05f11aaeaae203422d68ea012ae6d5efd50d338ad7db03efc92c
SHA512

c364de20a44bfa6c1b22997ef69c0f3cb53a319b368fae55c1ae6123fc563b984c9a8a76b0efcb5fbf97970c3822242c823637639a79719b42183d3a6eb72c10
SSDEEP

49152:9P6hSrcCPT0J+Lg31+mYGnKDATX7i2xG+:eujBmYGnKDATG2x5

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

BirikimOzeti.pdf.exe

description pid process target process

PID 2420 set thread context of 1788 2420 BirikimOzeti.pdf.exe regsvcs.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvcs.exe

pid process

1788 regsvcs.exe
1788 regsvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

regsvcs.exe

description pid process

Token: SeDebugPrivilege 1788 regsvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

regsvcs.exe

pid process

1788 regsvcs.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process	target process
PID 2420 set thread context of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe

pid	process
1788	regsvcs.exe
1788	regsvcs.exe

description	pid	process
Token: SeDebugPrivilege	1788	regsvcs.exe

pid	process
1788	regsvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

BirikimOzeti.pdf.exe

description	pid	process	target process
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 2260	2420	BirikimOzeti.pdf.exe	msbuild.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe
PID 2420 wrote to memory of 1788	2420	BirikimOzeti.pdf.exe	regsvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
2⤵
PID:2260

memory/1788-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1788-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1788-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1788-5-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/1788-6-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1788-7-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/1788-8-0x0000000074500000-0x0000000074BEE000-memory.dmp

Filesize
6.9MB

Download