agenttesla | 940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14

Analysis

max time kernel
131s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 22:00

Target

940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe
Size

1.2MB
MD5

f62d4211a12a08a5129e1a7af7ee860e
SHA1

4d85d30aeedfea586e0427355cee46a1ae7076b3
SHA256

940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14
SHA512

231be4788cd02a861e8171b4874f69abbc36d235dfde43a4eaa83b70eb6454c1dd6a42d4cf902e40e6734aab31a6260b9afa4eb12ce26bb5af30ded12539dcde
SSDEEP

24576:5JZMADBzPPQGA3zH6s5K4Z3LBz+c11wwupKJGg5kknrbkwh:RpZAmM3LhTwwupQpkk86

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

Processes:

940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe

description	pid	process	target process
PID 764 set thread context of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

installutil.exe

pid process

1492 installutil.exe
1492 installutil.exe
1492 installutil.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

installutil.exe

description pid process

Token: SeDebugPrivilege 1492 installutil.exe

description	pid	process
Token: SeDebugPrivilege	1492	installutil.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe

description	pid	process	target process
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1492	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1300	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1300	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe
PID 764 wrote to memory of 1300	764	940089bbf36611ee87fd96805eea9e203b94d6c2052c5fdb1c8db8ffdd044a14.exe	installutil.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
2⤵
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
1⤵
PID:4820

memory/764-0-0x00007FFE9FFB3000-0x00007FFE9FFB5000-memory.dmp

Filesize
8KB

Download
memory/764-1-0x0000019221D10000-0x0000019221D1A000-memory.dmp

Filesize
40KB

Download
memory/764-2-0x00007FFE9FFB0000-0x00007FFEA0A71000-memory.dmp

Filesize
10.8MB

Download
memory/764-3-0x00007FFE9FFB0000-0x00007FFEA0A71000-memory.dmp

Filesize
10.8MB

Download
memory/764-4-0x000001923A810000-0x000001923A8A2000-memory.dmp

Filesize
584KB

Download
memory/764-10-0x00007FFE9FFB0000-0x00007FFEA0A71000-memory.dmp

Filesize
10.8MB

Download
memory/1492-8-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/1492-7-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/1492-6-0x00000000753CE000-0x00000000753CF000-memory.dmp

Filesize
4KB

Download
memory/1492-9-0x00000000753C0000-0x0000000075B70000-memory.dmp

Filesize
7.7MB

Download
memory/1492-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1492-11-0x0000000006460000-0x00000000064B0000-memory.dmp

Filesize
320KB

Download
memory/1492-12-0x0000000006550000-0x00000000065E2000-memory.dmp

Filesize
584KB

Download
memory/1492-13-0x00000000064D0000-0x00000000064DA000-memory.dmp

Filesize
40KB

Download
memory/1492-14-0x00000000753CE000-0x00000000753CF000-memory.dmp

Filesize
4KB

Download
memory/1492-15-0x00000000753C0000-0x0000000075B70000-memory.dmp

Filesize
7.7MB

Download