agenttesla | ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 14:39

Target

ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe
Size

1009KB
MD5

72b1dfb60cae17dc577fa43347f69c41
SHA1

5eeb711eb6ade3532a11443fe10941ab15c47a52
SHA256

ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3
SHA512

627e70d818922bc93784f977e6111f5ec5e87da5c6053317854be7de78dfe31d73783a36cae61d1b8e3c2a7b8a5108c2a0a2a06d49f56fd5377556e8d19f9e01
SSDEEP

24576:TAHnh+eWsN3skA4RV1Hom2KXMmHaukON3e7NDR1kt45:eh+ZkldoPK8YauNI7NV1ko

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 api.ipify.org
16 api.ipify.org

flow	ioc
14	api.ipify.org
16	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

description	pid	process	target process
PID 3332 set thread context of 2448	3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe	RegSvcs.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1444 3332 WerFault.exe ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

2448 RegSvcs.exe
2448 RegSvcs.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

pid process

3332 ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2448 RegSvcs.exe

pid	pid_target	process	target process
1444	3332	WerFault.exe	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

pid	process
2448	RegSvcs.exe
2448	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2448	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

pid	process
3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe
3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

pid	process
3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe
3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe

description	pid	process	target process
PID 3332 wrote to memory of 2448	3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe	RegSvcs.exe
PID 3332 wrote to memory of 2448	3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe	RegSvcs.exe
PID 3332 wrote to memory of 2448	3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe	RegSvcs.exe
PID 3332 wrote to memory of 2448	3332	ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe
"C:\Users\Admin\AppData\Local\Temp\ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\ab67341a64bb5e48f68d3d942f96ef10fbc59c118a43ba2dad0c533ffd391be3.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 696
  2⤵
  - Program crash
  PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3332 -ip 3332
1⤵
PID:2168

memory/2448-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2448-12-0x00000000736BE000-0x00000000736BF000-memory.dmp

Filesize
4KB

Download
memory/2448-13-0x00000000059E0000-0x0000000005F84000-memory.dmp

Filesize
5.6MB

Download
memory/2448-14-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/2448-15-0x00000000736B0000-0x0000000073E60000-memory.dmp

Filesize
7.7MB

Download
memory/2448-16-0x00000000067F0000-0x0000000006840000-memory.dmp

Filesize
320KB

Download
memory/2448-17-0x00000000068E0000-0x0000000006972000-memory.dmp

Filesize
584KB

Download
memory/2448-18-0x0000000006860000-0x000000000686A000-memory.dmp

Filesize
40KB

Download
memory/2448-19-0x00000000736BE000-0x00000000736BF000-memory.dmp

Filesize
4KB

Download
memory/2448-20-0x00000000736B0000-0x0000000073E60000-memory.dmp

Filesize
7.7MB

Download
memory/3332-10-0x0000000000B60000-0x0000000000B64000-memory.dmp

Filesize
16KB

Download