agenttesla | 4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe
Size 580KB
Sample240612-ckph3aydnf
SHA256 4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965
MD5 e3f571bd6aea26e6f2721cd147e3aeac
SHA1 3cffb12aeebff9c1260b333c980a028f2403c677
SHA512 1cfdf95374a749e44ca3fb488ca2ce9fa52a60bf50d9d21f5df1ee5927d0a7fb8ef5d24c6f65b4fd6c4cb893ff97e3a1cdc5201b288619d670425ccbb382123f
SSDEEP 12288:eDYaW1FIIt8pBFlCVvAFCVMEBJ1UN5sg8YbbWKBQ:eDYr1Fxt8L5FgLSH8Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.nsatech.co
Port
587
Username
[email protected]
Password
Hn064008007320212021

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.nsatech.co
Port
587
Username
[email protected]
Password
Hn064008007320212021
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4980 set thread context of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4004	AddInProcess32.exe
4004	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80
PID 4980 wrote to memory of 4004	4980	4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe	80

C:\Users\Admin\AppData\Local\Temp\4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe
"C:\Users\Admin\AppData\Local\Temp\4c81475320e48a5ba2d483e200d1e5748fba7596ca3df92d4e803464bb186965.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4004-6-0x0000000005210000-0x0000000005276000-memory.dmp

Download

memory/4004-10-0x0000000006200000-0x000000000629C000-memory.dmp

Download

memory/4004-14-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/4004-3-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4004-4-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Download

memory/4004-5-0x0000000005750000-0x0000000005CF4000-memory.dmp

Download

memory/4004-13-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Download

memory/4004-12-0x0000000006560000-0x000000000656A000-memory.dmp

Download

memory/4004-11-0x00000000065C0000-0x0000000006652000-memory.dmp

Download

memory/4004-9-0x0000000006110000-0x0000000006160000-memory.dmp

Download

memory/4004-7-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/4980-1-0x00007FFFAE803000-0x00007FFFAE805000-memory.dmp

Download

memory/4980-8-0x00007FFFAE800000-0x00007FFFAF2C1000-memory.dmp

Download

memory/4980-0-0x000001CD261A0000-0x000001CD26236000-memory.dmp

Download

memory/4980-2-0x00007FFFAE800000-0x00007FFFAF2C1000-memory.dmp

Download