agenttesla | c685ab98e1910af3a51286a6d68d706e2a7be5298f74c061f98b9e87e290d357

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe
Size

2.0MB
MD5

d81b4a2a5f96fb13ba259a1fae296ace
SHA1

ba47840dfff065356f10a05464c75c6a4cb70b7a
SHA256

c685ab98e1910af3a51286a6d68d706e2a7be5298f74c061f98b9e87e290d357
SHA512

586908b31e61657f9f55b914f5b3a5b232ea1d1219025d2765a8d5f5bf35aa127d610d82c597bc38ddc8d69167179f068949a72ae28ab2f9732f0b2f76ba7bb8
SSDEEP

24576:kynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52tOXuq01dKqOFCBvx1prO:VjN3CdJ81nEQhs30eruqsrOFCBbprO

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
BTwcMq@2
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe

description pid process target process

PID 1700 set thread context of 2300 1700 Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe jsc.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

jsc.exe

pid process

2300 jsc.exe
2300 jsc.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

jsc.exe

description pid process

Token: SeDebugPrivilege 2300 jsc.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process	target process
PID 1700 set thread context of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe

pid	process
2300	jsc.exe
2300	jsc.exe

description	pid	process
Token: SeDebugPrivilege	2300	jsc.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe

description	pid	process	target process
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2608	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	installutil.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe
PID 1700 wrote to memory of 2300	1700	Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	jsc.exe

C:\Users\Admin\AppData\Local\Temp\Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Zamów nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:2608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2300-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2300-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2300-5-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/2300-6-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2300-7-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/2300-8-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download