agenttesla | 8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75 | Triage

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:55

Sharing

Report Analysis Logs

General

Target

8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe
Size

1019KB
MD5

ca82319fef771a184d1f98750e5bbb21
SHA1

11893474d3fd90f57cde4f16bfc153b4448d1363
SHA256

8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75
SHA512

f84517ddb447def1f621a468e442cf5ffd4fdff90a2df35f88df059bfddbd0d4cf336e94b8af5e2cd2ce79cc6c372e20171931deb3af5fdf15f3092e3b7dcd3c
SSDEEP

24576:NAHnh+eWsN3skA4RV1Hom2KXMmHazXBHMfJ5:sh+ZkldoPK8YazXBHA

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.midhcodistribuciones.com
Port:
21
Username:
[email protected]
Password:
,A7}+JV4KExQ

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

description	pid	process	target process
PID 3968 set thread context of 1104	3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid process

1104 RegSvcs.exe
1104 RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

pid	process
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1104 RegSvcs.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

pid	process
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

pid	process
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe
3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe

description	pid	process	target process
PID 3968 wrote to memory of 1104	3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe	RegSvcs.exe
PID 3968 wrote to memory of 1104	3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe	RegSvcs.exe
PID 3968 wrote to memory of 1104	3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe	RegSvcs.exe
PID 3968 wrote to memory of 1104	3968	8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe
"C:\Users\Admin\AppData\Local\Temp\8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\8c8f6c263d24354338e5d2d50d671a6e529d902be66962dab85932a326477e75.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-11-0x0000000000510000-0x0000000000552000-memory.dmp

Filesize
264KB

Download
memory/1104-12-0x00000000741EE000-0x00000000741EF000-memory.dmp

Filesize
4KB

Download
memory/1104-13-0x00000000050B0000-0x0000000005654000-memory.dmp

Filesize
5.6MB

Download
memory/1104-14-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/1104-15-0x0000000004CA0000-0x0000000004D06000-memory.dmp

Filesize
408KB

Download
memory/1104-16-0x0000000005E50000-0x0000000005EA0000-memory.dmp

Filesize
320KB

Download
memory/1104-17-0x0000000005F40000-0x0000000005FD2000-memory.dmp

Filesize
584KB

Download
memory/1104-18-0x0000000005EC0000-0x0000000005ECA000-memory.dmp

Filesize
40KB

Download
memory/1104-19-0x00000000741EE000-0x00000000741EF000-memory.dmp

Filesize
4KB

Download
memory/1104-20-0x00000000741E0000-0x0000000074990000-memory.dmp

Filesize
7.7MB

Download
memory/3968-10-0x0000000000A00000-0x0000000000A04000-memory.dmp

Filesize
16KB

Download