agenttesla | 747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe
Size

1.2MB
MD5

45a16a0b082e9b7a39c3c9e89a7f50b4
SHA1

04c468ecc20e99e63b8defff04a953e640570ba4
SHA256

747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d
SHA512

4204ae993ed74034bc999e4049880e492d463bfc0c915d0bee6fa550fe3d354e27bf5a59411ccdb99d21f36edfee232e7d4138bd0229fa37edeba70619628240
SSDEEP

24576:BAHnh+eWsN3skA4RV1Hom2KXMmHa+gMrWENROPBc5:Yh+ZkldoPK8Yax0tMPA

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe

description	pid	process	target process
PID 1988 set thread context of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1624 RegSvcs.exe
1624 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe

pid process

1988 747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1624 RegSvcs.exe

pid	process
1624	RegSvcs.exe
1624	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1624	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe

pid	process
1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe
1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe

pid	process
1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe
1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe

description	pid	process	target process
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe
PID 1988 wrote to memory of 1624	1988	747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe
"C:\Users\Admin\AppData\Local\Temp\747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\747e2616e2c37f160fdfaa6df7b18e65c206788ad14b6002fadc72fe9863887d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\batchers

Filesize
261KB

MD5
82b3c99066849198615b71c96ed6d17f

SHA1
45b700981c3005bda5ace7049b3069d96cb49e0a

SHA256
c051026e4ddf0e49eb68ac83e787e7dac8fb2a71ba27f9d05908d8df27e8a1bc

SHA512
67e65b12aa491b4f9553c7f9cfdd84c03bbdabc1e7c903d938414a8930877478934a9c17121aaafdf024fc1cf778e91b21620e47a2f4158457ce4a51541a0530

Download Submit
memory/1624-58-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-15-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1624-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1624-1068-0x0000000073BC0000-0x00000000742AE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-16-0x0000000073BCE000-0x0000000073BCF000-memory.dmp

Filesize
4KB

Download
memory/1624-17-0x0000000002030000-0x0000000002084000-memory.dmp

Filesize
336KB

Download
memory/1624-18-0x00000000021B0000-0x0000000002202000-memory.dmp

Filesize
328KB

Download
memory/1624-19-0x0000000073BC0000-0x00000000742AE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-80-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-72-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-62-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-54-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-56-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-82-0x0000000073BC0000-0x00000000742AE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-76-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-74-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-70-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-68-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-66-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-64-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-60-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1624-78-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-52-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-49-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-50-0x0000000073BC0000-0x00000000742AE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-47-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-45-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-43-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-41-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-39-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-37-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-35-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-33-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-31-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-29-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-27-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-25-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-23-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-21-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-20-0x00000000021B0000-0x00000000021FD000-memory.dmp

Filesize
308KB

Download
memory/1624-1052-0x0000000073BC0000-0x00000000742AE000-memory.dmp

Filesize
6.9MB

Download
memory/1624-1067-0x0000000073BCE000-0x0000000073BCF000-memory.dmp

Filesize
4KB

Download
memory/1988-11-0x0000000000310000-0x0000000000314000-memory.dmp

Filesize
16KB

Download