agenttesla | a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
Size

1.2MB
MD5

3f02a2516380a49f81ae8e15e7f548cc
SHA1

282b7fca5197f2257c91e61e5dbbcfdcab9df9eb
SHA256

a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017
SHA512

4c2d392b2bf2cd3c1a14a5bd7a2aef9b7d84c46c0c0180979bc21bdc3e9ef4a069c8e97d843a43f0cc984003e176b719a21705f4a98ae74a4e9a521e527997a4
SSDEEP

24576:iAHnh+eWsN3skA4RV1Hom2KXMmHaYdQOhQHQVQH8bj5QF5:lh+ZkldoPK8YaYibHP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2720	RegSvcs.exe
2720	RegSvcs.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2720	RegSvcs.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2760	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	28
PID 2928 wrote to memory of 2760	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	28
PID 2928 wrote to memory of 2760	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	28
PID 2928 wrote to memory of 2760	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	28
PID 2928 wrote to memory of 2760	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	28
PID 2928 wrote to memory of 2760	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	28
PID 2928 wrote to memory of 2760	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	28
PID 2928 wrote to memory of 2640	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	29
PID 2928 wrote to memory of 2640	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	29
PID 2928 wrote to memory of 2640	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	29
PID 2928 wrote to memory of 2640	2928	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	29
PID 2640 wrote to memory of 2712	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	30
PID 2640 wrote to memory of 2712	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	30
PID 2640 wrote to memory of 2712	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	30
PID 2640 wrote to memory of 2712	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	30
PID 2640 wrote to memory of 2712	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	30
PID 2640 wrote to memory of 2712	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	30
PID 2640 wrote to memory of 2712	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	30
PID 2640 wrote to memory of 2728	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	31
PID 2640 wrote to memory of 2728	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	31
PID 2640 wrote to memory of 2728	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	31
PID 2640 wrote to memory of 2728	2640	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	31
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32
PID 2728 wrote to memory of 2720	2728	a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe	32

C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
"C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"
  2⤵
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
  "C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"
    3⤵
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe
    "C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\a38d11fe4e93ba2f88c70c336a98b0f093508fea47967b5a6a7784a7e5a90017.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut1305.tmp

Filesize
9KB

MD5
6a7c2029ecf1dce46416c7fc3fcba355

SHA1
4dcbdfd1e878c92b7476889873f47f6209c4907f

SHA256
398090cda22b48d439d0db3381b912f8d90d00c4df3dc1182194a4b11a1461f3

SHA512
c4fdc832b08e4b4ed001c05e77bc586d7f71a3e69d35143739770cae650ca4f3d1d47ee2f6672df8cc9a04cb1ae3097c04b6b3a0c72330b7a7acab453c33d7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\intemeration

Filesize
28KB

MD5
3ada8e4b5d2e14594140cc4eece28f46

SHA1
012c8e4896652703f01483c9df0be3ce520095f2

SHA256
3f66d1eee75d1eeb9856ff140f415519f688785ae3d2ec02bbf618b6095997ba

SHA512
1f2b063d3f39eddff78724ccc6bc48366a8f7cbdf06f5d87914492a95250476f29f913ab85d1d103c678409b09d1b1877e03523d6f3010990dd07202af72ba24

Download Submit
C:\Users\Admin\AppData\Local\Temp\putrefactible

Filesize
262KB

MD5
c3f40d425d3a0ca4b4b41b6caaa0d718

SHA1
098602fbfffaa0498747bf00192e62329e17685e

SHA256
ef7c97b98f5b48fb212a0644860f18db870283d0e81a99af7103fe40f8b111d9

SHA512
9c71fe0c3212e04a8afa02c75e92cf620c645a5f2e75ffed1f17580f2ac6d37e8b9a990ea88061df7aa756719f480dfbf4cd437f7f0f2f593e0a98cd49aefce0

Download Submit
memory/2720-84-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-98-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-40-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2720-41-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2720-42-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/2720-43-0x0000000000B20000-0x0000000000B74000-memory.dmp

Filesize
336KB

Download
memory/2720-44-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2720-45-0x0000000000BE0000-0x0000000000C32000-memory.dmp

Filesize
328KB

Download
memory/2720-46-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2720-96-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-271-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2720-106-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-104-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-76-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-100-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-78-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-94-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-92-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-90-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-88-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-1081-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2720-82-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-38-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2720-80-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-102-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-74-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-72-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-68-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-66-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-65-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-62-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-60-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-59-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-56-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-54-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-52-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-50-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-48-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-86-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-70-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-47-0x0000000000BE0000-0x0000000000C2D000-memory.dmp

Filesize
308KB

Download
memory/2720-1078-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/2720-1079-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2720-1080-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/2928-11-0x0000000000120000-0x0000000000124000-memory.dmp

Filesize
16KB

Download