agenttesla | 566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61

Analysis

max time kernel
105s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
Size

1.1MB
MD5

32126d19a3ae881231dcf8206de936ac
SHA1

4382018d3d2b0930eb4946b30214cf7d90a1f24f
SHA256

566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61
SHA512

105b9c2279cb36a2ead371b483b7cf3c5fe20d18bf1c3f23386b6272595a893e4ae65b556da757106199ea330b45e0026911dd6bbecf4a0a845fbc8e2605b610
SSDEEP

24576:LAHnh+eWsN3skA4RV1Hom2KXMmHa4Dio3pzobjt7wrxjb5:mh+ZkldoPK8Ya4DiKAZErxp

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com
14	api.ipify.org
16	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2636 set thread context of 3952	2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	RegSvcs.exe
3952	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2004	1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	84
PID 1316 wrote to memory of 2004	1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	84
PID 1316 wrote to memory of 2004	1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	84
PID 1316 wrote to memory of 2636	1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	85
PID 1316 wrote to memory of 2636	1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	85
PID 1316 wrote to memory of 2636	1316	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	85
PID 2636 wrote to memory of 3952	2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	86
PID 2636 wrote to memory of 3952	2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	86
PID 2636 wrote to memory of 3952	2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	86
PID 2636 wrote to memory of 3952	2636	566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe	86

C:\Users\Admin\AppData\Local\Temp\566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
"C:\Users\Admin\AppData\Local\Temp\566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe"
  2⤵
  PID:2004
- C:\Users\Admin\AppData\Local\Temp\566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe
  "C:\Users\Admin\AppData\Local\Temp\566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\566d8d4d30d0c6b04f89eaa3e0a15b365ba27da3383d7e07454671cc66037e61.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-10-0x0000000003900000-0x0000000003904000-memory.dmp

Filesize
16KB

Download
memory/3952-24-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3952-26-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3952-27-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/3952-28-0x0000000003130000-0x0000000003186000-memory.dmp

Filesize
344KB

Download
memory/3952-29-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-31-0x0000000005640000-0x0000000005694000-memory.dmp

Filesize
336KB

Download
memory/3952-50-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-94-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-92-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-88-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-86-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-82-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-80-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-79-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-76-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-1100-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-1099-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/3952-74-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-72-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-71-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-68-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-64-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-62-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-60-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-58-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-54-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-90-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-84-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-70-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-66-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-56-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-52-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-48-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-46-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-44-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-42-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-40-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-38-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-36-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-34-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-33-0x0000000005640000-0x000000000568F000-memory.dmp

Filesize
316KB

Download
memory/3952-32-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download
memory/3952-30-0x0000000005B90000-0x0000000006134000-memory.dmp

Filesize
5.6MB

Download
memory/3952-25-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3952-23-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3952-1101-0x0000000006BF0000-0x0000000006C40000-memory.dmp

Filesize
320KB

Download
memory/3952-1102-0x0000000006CE0000-0x0000000006D72000-memory.dmp

Filesize
584KB

Download
memory/3952-1103-0x0000000006C60000-0x0000000006C6A000-memory.dmp

Filesize
40KB

Download
memory/3952-1104-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3952-1105-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

Filesize
4KB

Download
memory/3952-1106-0x0000000074B00000-0x00000000752B0000-memory.dmp

Filesize
7.7MB

Download