agenttesla | b2ebb908944dcf31b253f02097b86b3e1f96fe094bbcc7c2c37718ade401991c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 07:30

Target

PP-X-CC-0103188098.exe
Size

1005KB
MD5

753373ea799f4286a93a3f4527b3888b
SHA1

a6865cc98ab5659ed16eb3781100d0b85ba86af3
SHA256

b2ebb908944dcf31b253f02097b86b3e1f96fe094bbcc7c2c37718ade401991c
SHA512

5fbe15c82873bf667ef26ce18703f3883e724456e379795bee989f841b9ff002430be5d8b4382f84e30bb8982ccb67af10d61d683422158928f651d1441e0555
SSDEEP

24576:WAHnh+eWsN3skA4RV1Hom2KXMmHax/yNI17L/i5:xh+ZkldoPK8YaxuS7M

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Suspicious use of SetThreadContext 1 IoCs

Processes:

PP-X-CC-0103188098.exe

description pid process target process

PID 4124 set thread context of 1060 4124 PP-X-CC-0103188098.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2596 4124 WerFault.exe PP-X-CC-0103188098.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1060 RegSvcs.exe
1060 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

PP-X-CC-0103188098.exe

pid process

4124 PP-X-CC-0103188098.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1060 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

PP-X-CC-0103188098.exe

pid process

4124 PP-X-CC-0103188098.exe
4124 PP-X-CC-0103188098.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

PP-X-CC-0103188098.exe

pid process

4124 PP-X-CC-0103188098.exe
4124 PP-X-CC-0103188098.exe

description	pid	process	target process
PID 4124 set thread context of 1060	4124	PP-X-CC-0103188098.exe	RegSvcs.exe

pid	pid_target	process	target process
2596	4124	WerFault.exe	PP-X-CC-0103188098.exe

pid	process
1060	RegSvcs.exe
1060	RegSvcs.exe

pid	process
4124	PP-X-CC-0103188098.exe

description	pid	process
Token: SeDebugPrivilege	1060	RegSvcs.exe

pid	process
4124	PP-X-CC-0103188098.exe
4124	PP-X-CC-0103188098.exe

pid	process
4124	PP-X-CC-0103188098.exe
4124	PP-X-CC-0103188098.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

PP-X-CC-0103188098.exe

description	pid	process	target process
PID 4124 wrote to memory of 1060	4124	PP-X-CC-0103188098.exe	RegSvcs.exe
PID 4124 wrote to memory of 1060	4124	PP-X-CC-0103188098.exe	RegSvcs.exe
PID 4124 wrote to memory of 1060	4124	PP-X-CC-0103188098.exe	RegSvcs.exe
PID 4124 wrote to memory of 1060	4124	PP-X-CC-0103188098.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\PP-X-CC-0103188098.exe
"C:\Users\Admin\AppData\Local\Temp\PP-X-CC-0103188098.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\PP-X-CC-0103188098.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 696
  2⤵
  - Program crash
  PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
1⤵
PID:3912

memory/1060-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1060-12-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/1060-13-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/1060-14-0x00000000056A0000-0x0000000005706000-memory.dmp

Filesize
408KB

Download
memory/1060-15-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/1060-16-0x0000000006590000-0x00000000065E0000-memory.dmp

Filesize
320KB

Download
memory/1060-17-0x0000000006680000-0x0000000006712000-memory.dmp

Filesize
584KB

Download
memory/1060-18-0x0000000006620000-0x000000000662A000-memory.dmp

Filesize
40KB

Download
memory/1060-19-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/1060-20-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/4124-10-0x0000000003D70000-0x0000000003D74000-memory.dmp

Filesize
16KB

Download