agenttesla | bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 01:14

Target

bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe
Size

662KB
MD5

19ea2750dda72a07006f545dc22086e3
SHA1

1f4094ddefe7626a9443a3cba938c67559a43da3
SHA256

bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db
SHA512

47166ed634346472ee7eaccf822e19210d95c12a47219b69c65b99043929f2aeae2cb726f3f90563ce1760bb8c14fe10bfce7ccecfb811995ccc354c10427af3
SSDEEP

12288:FHnOZj7xkozuB4P/ml559x9do3YZKC/yIDaDFYElWo9rnN1NfTENVEYMbtSXBHzq:FHOZHuozuC/ujX57yIGDFZE+rnN8rMMI

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6413426905:AAHR9s_zKOMZ8VqS2ZoMm3UZaHZoNPS_D_Y/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	CasPol.exe
2604	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2604	CasPol.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28
PID 2084 wrote to memory of 2604	2084	bb0da0bb4d9e2bbda52246946faaff37b7a0ee64922f84f70eb5f7355f6827db.exe	28

memory/2084-0-0x00000000742CE000-0x00000000742CF000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x0000000000050000-0x00000000000FA000-memory.dmp

Filesize
680KB

Download
memory/2084-2-0x00000000041C0000-0x000000000425E000-memory.dmp

Filesize
632KB

Download
memory/2084-4-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2084-3-0x0000000000470000-0x000000000048A000-memory.dmp

Filesize
104KB

Download
memory/2084-10-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2604-9-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2604-11-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2604-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2604-5-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2604-12-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download
memory/2604-13-0x00000000742C0000-0x00000000749AE000-memory.dmp

Filesize
6.9MB

Download