agenttesla | b91efae02550a1811e1607d91ede6b23bc5aad062a80518c1b969ff4d4413228

Analysis

max time kernel
103s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe
Size 1.6MB
Sample240613-bq2vxayfmd
SHA256 a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265
MD5 2fa23a2e93b10ae07013e24692f35b6d
SHA1 9481be2f68a244f9825295fda01c5f1fce66648d
SHA512 21ecbe170b529c7373d9eda6750eaa7c7a578d995e75f54c4466ae2132dae0ec5f2d79e4fefceb05016b965031d2fdf568da604dfb367a886face4af10c5bacd
SSDEEP 12288:HEzZEAmD9/RR3biUuyjpgebm6YRAbAZRwox15bGz5XWCMmsI8txwFF71a0:HEzZ6/RR3b4spUZRJ15beWCMmywPp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.trisquarespl.com
Port
587
Username
[email protected]
Password
#)YFjJf1

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.trisquarespl.com
Port
587
Username
[email protected]
Password
#)YFjJf1
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.ipify.org
12	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1904 set thread context of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2956	jsc.exe
2956	jsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe
Token: SeDebugPrivilege	2956	jsc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 2956	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	84
PID 1904 wrote to memory of 3256	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	85
PID 1904 wrote to memory of 3256	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	85
PID 1904 wrote to memory of 3256	1904	a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe	85

C:\Users\Admin\AppData\Local\Temp\a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe
"C:\Users\Admin\AppData\Local\Temp\a2692baba867417cdb7c2a5b1c1ab8eec75a0359962872fdd218f844e836f265.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1904-1-0x00007FFDE86B3000-0x00007FFDE86B5000-memory.dmp

Download

memory/1904-0-0x00000218FAF70000-0x00000218FAF8E000-memory.dmp

Download

memory/1904-2-0x00007FFDE86B0000-0x00007FFDE9171000-memory.dmp

Download

memory/1904-3-0x0000021898650000-0x00000218986E4000-memory.dmp

Download

memory/1904-9-0x00007FFDE86B0000-0x00007FFDE9171000-memory.dmp

Download

memory/2956-8-0x0000000074F90000-0x0000000075740000-memory.dmp

Download

memory/2956-6-0x0000000005C40000-0x00000000061E4000-memory.dmp

Download

memory/2956-7-0x00000000055E0000-0x0000000005646000-memory.dmp

Download

memory/2956-5-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

Download

memory/2956-4-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2956-10-0x0000000006D70000-0x0000000006DC0000-memory.dmp

Download

memory/2956-11-0x0000000006E60000-0x0000000006EFC000-memory.dmp

Download

memory/2956-12-0x0000000006FA0000-0x0000000007032000-memory.dmp

Download

memory/2956-13-0x0000000006F30000-0x0000000006F3A000-memory.dmp

Download

memory/2956-14-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

Download

memory/2956-15-0x0000000074F90000-0x0000000075740000-memory.dmp

Download