agenttesla | c2901aebb7af70fd74d9812932c5c7028711828696b3aa0f563cb6dfc82d22b9

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 13:06

Target

rTTSWIFT_8374783.exe
Size

1016KB
MD5

3f01bf70d956ec19a92b35f7a9c96c23
SHA1

acb67c8df40ee9369cd18630282f4706a2bf2623
SHA256

c2901aebb7af70fd74d9812932c5c7028711828696b3aa0f563cb6dfc82d22b9
SHA512

37b9a414aca0c0b05a916094ae72faee8307f1568888d5ab65a84fd75332cd0142b34e1b9f7b4dcd41bce3d9c414669ad2c12e90a3ab7fa9ff2906fc6294cb16
SSDEEP

24576:wAHnh+eWsN3skA4RV1Hom2KXMmHaFLfy4e33w5:nh+ZkldoPK8YaFLfW3G

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

rTTSWIFT_8374783.exe

description pid process target process

PID 1612 set thread context of 4728 1612 rTTSWIFT_8374783.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 1612 WerFault.exe rTTSWIFT_8374783.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

4728 RegSvcs.exe
4728 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rTTSWIFT_8374783.exe

pid process

1612 rTTSWIFT_8374783.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 4728 RegSvcs.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

rTTSWIFT_8374783.exe

pid process

1612 rTTSWIFT_8374783.exe
1612 rTTSWIFT_8374783.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

rTTSWIFT_8374783.exe

pid process

1612 rTTSWIFT_8374783.exe
1612 rTTSWIFT_8374783.exe

flow	ioc
14	ip-api.com

description	pid	process	target process
PID 1612 set thread context of 4728	1612	rTTSWIFT_8374783.exe	RegSvcs.exe

pid	pid_target	process	target process
1184	1612	WerFault.exe	rTTSWIFT_8374783.exe

pid	process
4728	RegSvcs.exe
4728	RegSvcs.exe

pid	process
1612	rTTSWIFT_8374783.exe

description	pid	process
Token: SeDebugPrivilege	4728	RegSvcs.exe

pid	process
1612	rTTSWIFT_8374783.exe
1612	rTTSWIFT_8374783.exe

pid	process
1612	rTTSWIFT_8374783.exe
1612	rTTSWIFT_8374783.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

rTTSWIFT_8374783.exe

description	pid	process	target process
PID 1612 wrote to memory of 4728	1612	rTTSWIFT_8374783.exe	RegSvcs.exe
PID 1612 wrote to memory of 4728	1612	rTTSWIFT_8374783.exe	RegSvcs.exe
PID 1612 wrote to memory of 4728	1612	rTTSWIFT_8374783.exe	RegSvcs.exe
PID 1612 wrote to memory of 4728	1612	rTTSWIFT_8374783.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\rTTSWIFT_8374783.exe
"C:\Users\Admin\AppData\Local\Temp\rTTSWIFT_8374783.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\rTTSWIFT_8374783.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 692
  2⤵
  - Program crash
  PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
1⤵
PID:3588

memory/1612-10-0x00000000015C0000-0x00000000015C4000-memory.dmp

Filesize
16KB

Download
memory/4728-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4728-12-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/4728-13-0x0000000005830000-0x0000000005DD4000-memory.dmp

Filesize
5.6MB

Download
memory/4728-14-0x00000000052F0000-0x0000000005356000-memory.dmp

Filesize
408KB

Download
memory/4728-15-0x0000000074340000-0x0000000074AF0000-memory.dmp

Filesize
7.7MB

Download
memory/4728-16-0x00000000065A0000-0x00000000065F0000-memory.dmp

Filesize
320KB

Download
memory/4728-17-0x0000000006690000-0x0000000006722000-memory.dmp

Filesize
584KB

Download
memory/4728-18-0x0000000006620000-0x000000000662A000-memory.dmp

Filesize
40KB

Download
memory/4728-19-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/4728-20-0x0000000074340000-0x0000000074AF0000-memory.dmp

Filesize
7.7MB

Download