agenttesla | 97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe
Size

2.0MB
MD5

8f184daf4d3d0fac93db93c798e616ed
SHA1

f8c6c99b7e0572347ed1bee3ddb425e31f6cb643
SHA256

97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f
SHA512

652d87c3ce83e960f3aa0edc2b16d8003b8b8a52d6025afb2818303b2d92ea4d123f3269249b751dff3d421ba46f9460d0d3c48be826808bfe4eaae9be21cd3e
SSDEEP

24576:8ynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52AOXuq01dKqOFFSyF8FaE:9jN3CdJ81nEQhs30eouqsrOFXOaE

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot7043330881:AAFq19dRSS-89_wbwEvbuucof5Z3tCHG2NY/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1748 set thread context of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2536	AddInProcess32.exe
2536	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	AddInProcess32.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2308	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	29
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30
PID 1748 wrote to memory of 2536	1748	97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe	30

C:\Users\Admin\AppData\Local\Temp\97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe
"C:\Users\Admin\AppData\Local\Temp\97fa9df0ae7536db7c2427ff65ba51db3bbd22ebe957bf406ebe3f4ba4a46f7f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  PID:2308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2536-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-2-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-5-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

Filesize
4KB

Download
memory/2536-6-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download
memory/2536-21-0x0000000074E7E000-0x0000000074E7F000-memory.dmp

Filesize
4KB

Download
memory/2536-22-0x0000000074E70000-0x000000007555E000-memory.dmp

Filesize
6.9MB

Download