agenttesla | 8cba27793eb477e7eb12574f1a529c2dce2c4eb9a17a3cbb513f9505bfe32cae

Analysis

max time kernel
15s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
Size 635KB
Sample240610-dlzabsbc2x
SHA256 8cba27793eb477e7eb12574f1a529c2dce2c4eb9a17a3cbb513f9505bfe32cae
MD5 0801012a2c93ecb8a6e359244cac8cd0
SHA1 cf346c3816aa4487163df89f4f949a664a3f2023
SHA512 16c266eea2da408ef54bb845d1dad7f88b91af9d001119d09dbb37b21b183ff4d9d1cbf0be8a7cf21a9c0a54defb3fbb932e893062cc510f2ceece77a6953420
SSDEEP 12288:lXATRthqXdwQ5nlxA2C20WtIaVkG2cCzKPZIwygfIh5Xgu7X9xlJX30qjqyJMY:l6RWNwQC2/VpCGBdyRXgu77/nYO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.destinationtoplan.com
Port
587
Username
[email protected]
Password
Alora..101
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
2624	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
2624	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2624	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2696	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	28
PID 2196 wrote to memory of 2696	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	28
PID 2196 wrote to memory of 2696	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	28
PID 2196 wrote to memory of 2696	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	28
PID 2196 wrote to memory of 2712	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2712	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2712	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2712	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2856	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2856	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2856	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2856	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2624	2196	0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe	31

C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"
  2⤵
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"
  2⤵
  PID:2712
- C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"
  2⤵
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\0801012a2c93ecb8a6e359244cac8cd0_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-0-0x00000000742FE000-0x00000000742FF000-memory.dmp

Download

memory/2196-1-0x0000000000F40000-0x0000000000FE6000-memory.dmp

Download

memory/2196-2-0x00000000742F0000-0x00000000749DE000-memory.dmp

Download

memory/2196-3-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2196-5-0x0000000000430000-0x0000000000440000-memory.dmp

Download

memory/2196-4-0x0000000000420000-0x000000000042E000-memory.dmp

Download

memory/2196-6-0x0000000004530000-0x00000000045B2000-memory.dmp

Download

memory/2196-22-0x00000000742F0000-0x00000000749DE000-memory.dmp

Download

memory/2624-23-0x00000000742F0000-0x00000000749DE000-memory.dmp

Download

memory/2624-12-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2624-21-0x00000000742F0000-0x00000000749DE000-memory.dmp

Download

memory/2624-20-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2624-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2624-16-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2624-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2624-11-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2624-9-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2624-7-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2624-24-0x00000000742F0000-0x00000000749DE000-memory.dmp

Download