agenttesla | be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1

Analysis

max time kernel
125s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe
Size 2.4MB
Sample240613-caek4stekr
SHA256 be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1
MD5 56ea662f81e2046af90a64c48ee52bbc
SHA1 2e6caa8bb37ffed61162d627e791d783fc9c246c
SHA512 4bf410112f91fbe6ddb0651a03d813599e9880d8cace303c796e00034ad600732536ba646b6a5915f77089d28e666f82c3877f51e5460c93994c2ee5abf14499
SSDEEP 12288:fki1leppJB3RHxYhE73tJZa6YJnH5Th9LTOPP/PUswjHffFzQxsycJUa6wLrxX4L:83S2tJCnHNhtOnPWZ3ycp6MNa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

https://api.telegram.org/bot7421278985:AAEjO3_rLC8SEEbjbuAiYz2IVSHDV_plUzk/

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4992 set thread context of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5064	CasPol.exe
5064	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	CasPol.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 5064	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	92
PID 4992 wrote to memory of 788	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	93
PID 4992 wrote to memory of 788	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	93
PID 4992 wrote to memory of 788	4992	be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe	93

C:\Users\Admin\AppData\Local\Temp\be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe
"C:\Users\Admin\AppData\Local\Temp\be209bce77ad8266549a85368534c5da704af681cb2d6feeb32e58a58402aab1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4256,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:8
1⤵
PID:836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4992-1-0x0000021D7EED0000-0x0000021D7EEEC000-memory.dmp

Download

memory/4992-0-0x00007FF8F0D53000-0x00007FF8F0D55000-memory.dmp

Download

memory/4992-2-0x00007FF8F0D50000-0x00007FF8F1811000-memory.dmp

Download

memory/4992-3-0x0000021D19650000-0x0000021D196E4000-memory.dmp

Download

memory/4992-9-0x00007FF8F0D50000-0x00007FF8F1811000-memory.dmp

Download

memory/5064-8-0x00000000748A0000-0x0000000075050000-memory.dmp

Download

memory/5064-6-0x0000000005FA0000-0x0000000006544000-memory.dmp

Download

memory/5064-7-0x00000000059F0000-0x0000000005A56000-memory.dmp

Download

memory/5064-5-0x00000000748AE000-0x00000000748AF000-memory.dmp

Download

memory/5064-4-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/5064-10-0x0000000006A30000-0x0000000006A80000-memory.dmp

Download

memory/5064-11-0x0000000006B20000-0x0000000006BBC000-memory.dmp

Download

memory/5064-12-0x0000000007160000-0x00000000071F2000-memory.dmp

Download

memory/5064-13-0x00000000070F0000-0x00000000070FA000-memory.dmp

Download

memory/5064-14-0x00000000748AE000-0x00000000748AF000-memory.dmp

Download

memory/5064-15-0x00000000748A0000-0x0000000075050000-memory.dmp

Download