agenttesla | 5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe
Size 1.0MB
Sample240612-bpap2axejb
SHA256 5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33
MD5 eb1adfc9f6b004fef37228f3900024e9
SHA1 aef3e592fc1129d939d054dfe8236a5c4b183869
SHA512 70986e36be6848a3671a78d1dd71a3b0dff75a650edc101095adffd08572a8f58e921327425b1ecf1da966337f0906d55ea8b7ab7b787e4efc174cf3eaecc812
SSDEEP 24576:ytj3JfA02w1wTJKFxHzXqkziwcQweB81HB8:6j5fA02w1wTJ4skzmK8T8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.hmc.com.pk
Port
587
Username
[email protected]
Password
scm@hmchmc
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
868	installutil.exe
868	installutil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe
Token: SeDebugPrivilege	868	installutil.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 868	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	28
PID 1464 wrote to memory of 2980	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	29
PID 1464 wrote to memory of 2980	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	29
PID 1464 wrote to memory of 2980	1464	5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe	29

C:\Users\Admin\AppData\Local\Temp\5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe
"C:\Users\Admin\AppData\Local\Temp\5466f276409fa5efe6da78ac653691972cfba009fd7095b7838e04c0e5aa6b33.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1464 -s 672
  2⤵
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/868-6-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/868-21-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Download

memory/868-20-0x00000000745DE000-0x00000000745DF000-memory.dmp

Download

memory/868-4-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/868-15-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/868-13-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/868-11-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/868-17-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Download

memory/868-16-0x00000000745DE000-0x00000000745DF000-memory.dmp

Download

memory/868-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/868-5-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/1464-0-0x000007FEF5773000-0x000007FEF5774000-memory.dmp

Download

memory/1464-1-0x00000000011A0000-0x00000000011B4000-memory.dmp

Download

memory/1464-18-0x000007FEF5773000-0x000007FEF5774000-memory.dmp

Download

memory/1464-19-0x000007FEF5770000-0x000007FEF615C000-memory.dmp

Download

memory/1464-3-0x0000000000850000-0x00000000008E4000-memory.dmp

Download

memory/1464-2-0x000007FEF5770000-0x000007FEF615C000-memory.dmp

Download