agenttesla | cb17b0203b43879a0b1dc7018bc32bd408c5b61c1a218e7f151c7229865d35e6

Analysis

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:07

Target

PO_37736OP48400.exe
Size

1010KB
MD5

56d9c71592654962c604e4b174b89765
SHA1

4a01911a00fa8898279f24564863cd87a08076d1
SHA256

490e033865350470d7edcb5aae610e3d89a1c3d5754efde517a75c3130d1596c
SHA512

e508dba6cc21476a50422e00902721ac3f984137858b017bcef15bad23a6238b5b1b4225318a25cf78216249cd0173c77c91d9f5142a9cabb12e812d635b0278
SSDEEP

24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaou4l/WAcpm5:fh+ZkldoPK8YaoRLcC

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4324 set thread context of 2496	4324	PO_37736OP48400.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3620	4324	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2496	RegSvcs.exe
2496	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4324	PO_37736OP48400.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4324	PO_37736OP48400.exe
4324	PO_37736OP48400.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4324	PO_37736OP48400.exe
4324	PO_37736OP48400.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 2496	4324	PO_37736OP48400.exe	87
PID 4324 wrote to memory of 2496	4324	PO_37736OP48400.exe	87
PID 4324 wrote to memory of 2496	4324	PO_37736OP48400.exe	87
PID 4324 wrote to memory of 2496	4324	PO_37736OP48400.exe	87

C:\Users\Admin\AppData\Local\Temp\PO_37736OP48400.exe
"C:\Users\Admin\AppData\Local\Temp\PO_37736OP48400.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\PO_37736OP48400.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 696
  2⤵
  - Program crash
  PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4324 -ip 4324
1⤵
PID:3800

memory/2496-11-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2496-12-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/2496-13-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/2496-14-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/2496-15-0x0000000074340000-0x0000000074AF0000-memory.dmp

Filesize
7.7MB

Download
memory/2496-16-0x0000000006970000-0x00000000069C0000-memory.dmp

Filesize
320KB

Download
memory/2496-17-0x0000000006A60000-0x0000000006AF2000-memory.dmp

Filesize
584KB

Download
memory/2496-18-0x00000000069E0000-0x00000000069EA000-memory.dmp

Filesize
40KB

Download
memory/2496-19-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/2496-20-0x0000000074340000-0x0000000074AF0000-memory.dmp

Filesize
7.7MB

Download
memory/4324-10-0x00000000021F0000-0x00000000021F4000-memory.dmp

Filesize
16KB

Download