agenttesla | c6e9ed35281ff6e8fa492cb7c29b5c49c495cb1c56b841484c927d8486299b3d

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order.exe
Size

916KB
MD5

43e578ebe45c2e4c078091635f84f511
SHA1

2a69714402d85deae610f811ca06f2816199c5e3
SHA256

c6e9ed35281ff6e8fa492cb7c29b5c49c495cb1c56b841484c927d8486299b3d
SHA512

bd90c855fe17fea16e43704b7d360e1958e5a1a325ee9fbd240f6322123882b390864c510c3ce2ea80a1ad66589752a169e9bf066e68ca5888273e431dceafd7
SSDEEP

12288:P8ZLe6pZoUf766py9205K6TBjtkPVXkSCyzkUfGt82me:0ZLeaeE7pyt5K6TBjtk5kS1Ot

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
us2.smtp.mailhostbox.com
Port:
587
Username:
[email protected]
Password:
UTjMgxC7qqqqG5651@@
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2312 set thread context of 2552	2312	Purchase Order.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	RegSvcs.exe
2552	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	RegSvcs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28
PID 2312 wrote to memory of 2552	2312	Purchase Order.exe	28

C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-17-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2312-1-0x0000000000E90000-0x0000000000F7C000-memory.dmp

Filesize
944KB

Download
memory/2312-2-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2312-3-0x0000000000380000-0x000000000039A000-memory.dmp

Filesize
104KB

Download
memory/2312-4-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2312-5-0x0000000005360000-0x00000000053E2000-memory.dmp

Filesize
520KB

Download
memory/2312-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

Filesize
4KB

Download
memory/2552-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-18-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2552-19-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/2552-20-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download