agenttesla | 21a48dddb72c624a2987ce341ab3c2a8ddf4055ee6f0fc3b2fa2da34bea73b08

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 13:52

Target

Sipariş PO #408232023_ZNG İstanbul_pdf.exe
Size

2.5MB
MD5

f55d77a9d704af55b0797de1435706e3
SHA1

93010de39c5e434291a439b65f6eb381b741edf3
SHA256

5302c416b0abd845fe3145f910e82440588c11219940fe89fd68722260a9b508
SHA512

0ad087c8a2290f890cb58535958566cf6a814415c58f20742d3074d27cd0e4e31f5f3d3a0a4945ec675c84ad99f9894c184ff69fcb702d19443a83729b19bddb
SSDEEP

49152:VP6hSrcCPT0J6Lg31+mYGnKDVTXShVr7oL:2ujRmYGnKDVTOr

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Sipariş PO #408232023_ZNG İstanbul_pdf.exe

description pid process target process

PID 1616 set thread context of 1708 1616 Sipariş PO #408232023_ZNG İstanbul_pdf.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AddInProcess32.exe

pid process

1708 AddInProcess32.exe
1708 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AddInProcess32.exe

description pid process

Token: SeDebugPrivilege 1708 AddInProcess32.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process	target process
PID 1616 set thread context of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe

pid	process
1708	AddInProcess32.exe
1708	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	1708	AddInProcess32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Sipariş PO #408232023_ZNG İstanbul_pdf.exe

description	pid	process	target process
PID 1616 wrote to memory of 2760	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	jsc.exe
PID 1616 wrote to memory of 2760	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	jsc.exe
PID 1616 wrote to memory of 2760	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	jsc.exe
PID 1616 wrote to memory of 2760	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	jsc.exe
PID 1616 wrote to memory of 2760	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	jsc.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe
PID 1616 wrote to memory of 1708	1616	Sipariş PO #408232023_ZNG İstanbul_pdf.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\Sipariş PO #408232023_ZNG İstanbul_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Sipariş PO #408232023_ZNG İstanbul_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:2760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

memory/1708-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1708-5-0x00000000742DE000-0x00000000742DF000-memory.dmp

Filesize
4KB

Download
memory/1708-6-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download
memory/1708-7-0x00000000742DE000-0x00000000742DF000-memory.dmp

Filesize
4KB

Download
memory/1708-8-0x00000000742D0000-0x00000000749BE000-memory.dmp

Filesize
6.9MB

Download