agenttesla | 90a250a9daaf0efe55cde73c6d05bf97c69e536e888b56d4564629c2e0ee242f

Analysis

max time kernel
106s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
Size 1.2MB
Sample240613-cplmzavbkr
SHA256 b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106
MD5 b987ae03e873b8b5f1e4b9c26a8401d3
SHA1 002d164dca14a55455f5d69965e1f26c3fecffa6
SHA512 852a07423d7b1f268a6473c375d7f6183ae5b12cfe6044c1d0b7389029a7a423fec3242ef5ecca96d9beb76699aba729f4f3f9b8c2affb4c52e16edc721da70a
SSDEEP 24576:WAHnh+eWsN3skA4RV1Hom2KXMmHaVdH5C0Mm307Tz2jo649m45:xh+ZkldoPK8YaVJmm32z2x49t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
23	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1532 set thread context of 1896	1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	95

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	RegSvcs.exe
1896	RegSvcs.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	RegSvcs.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2536	4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	84
PID 4564 wrote to memory of 2536	4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	84
PID 4564 wrote to memory of 2536	4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	84
PID 4564 wrote to memory of 2084	4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	85
PID 4564 wrote to memory of 2084	4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	85
PID 4564 wrote to memory of 2084	4564	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	85
PID 2084 wrote to memory of 4156	2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	87
PID 2084 wrote to memory of 4156	2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	87
PID 2084 wrote to memory of 4156	2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	87
PID 2084 wrote to memory of 3016	2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	88
PID 2084 wrote to memory of 3016	2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	88
PID 2084 wrote to memory of 3016	2084	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	88
PID 3016 wrote to memory of 4808	3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	90
PID 3016 wrote to memory of 4808	3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	90
PID 3016 wrote to memory of 4808	3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	90
PID 3016 wrote to memory of 4244	3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	91
PID 3016 wrote to memory of 4244	3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	91
PID 3016 wrote to memory of 4244	3016	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	91
PID 4244 wrote to memory of 3328	4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	93
PID 4244 wrote to memory of 3328	4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	93
PID 4244 wrote to memory of 3328	4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	93
PID 4244 wrote to memory of 1532	4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	94
PID 4244 wrote to memory of 1532	4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	94
PID 4244 wrote to memory of 1532	4244	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	94
PID 1532 wrote to memory of 1896	1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	95
PID 1532 wrote to memory of 1896	1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	95
PID 1532 wrote to memory of 1896	1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	95
PID 1532 wrote to memory of 1896	1532	b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe	95

C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
"C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
  "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
  2⤵
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
    3⤵
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
    "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
    3⤵
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
      4⤵
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
      "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
      4⤵
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
        5⤵
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b79bebd49ec717c79a291a46c7fef304974be170eab06d6fd14810bdb0593106.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

aut3D57.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut3D57.tmp
Size 259KB
SHA256 fc8f5d89d8053b91d3d195898c743fd38e3559af32c65a056a9ba049b28fdcb4
MD5 26a0c5a84d9765bb909996e87d7ba420
SHA1 4844a92408d508aabf185718a3d56bf93335ee98
SHA512 52b34aa75a3318df0d8f1307921f5f01b2be5e50c8e45f749b55b86467cc51145f78dd6e54ccd82d1f07c641a02adba885ce4af715bedf0b28a4edda761c20fd
SSDEEP 6144:+QqKug2Xr9SqwKTr+cBIWCd5QLzl/grX8CFN2SzDivr6MgD:ZqKLYjTX+caWe5OzNSsreDivmMA
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut3D68.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut3D68.tmp
Size 9KB
SHA256 7b24b56a9ec69532395e0007c020556c222f0b41de2998b0620b418a7dbb8ceb
MD5 9c465595302fa927c685b206429756f7
SHA1 b72fa14d5feb00bf902a6d640f513c6685731995
SHA512 b4d665d6bea4d4e83cfed17b5eba3530ced4b6ef507ed14ed36570351637b3b761313287c44c33e06a781a0ac5f0e97196035cf4175066398610dc246ddfde46
SSDEEP 192:na0ZsqLUGeKtxWQa85oMK6mXFV+Ig9O1JZsMOuLwFqkGmHQ9yLzokLvdP:azqLFLtx3a85W6OOT9Ob5OowF1Fw9o9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

parters

Path C:\Users\Admin\AppData\Local\Temp\parters
Size 262KB
SHA256 d94c0dc84810831939864143798dd2ee05625d9b26c37759d69964b12904b49d
MD5 9c649ec2ca5f121ee157821364532331
SHA1 4ad662a1bd8c145ca979b95c5ae9c8d370265e2c
SHA512 5cb5bd802a1b12bec71b3db7763d9c8085f4aa03acf13d9a4179a25d404b7dd159c0e7fdfff506aec4c89abb189193a3e94b1611968930c7f19e46c2569edf30
SSDEEP 6144:DEQCMCBc0st/pNcei+XmAYNk0GCUooze8kSCW9n+m4QG:DR7Qcb5pmeY7G9PzREEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

putrefactible

Path C:\Users\Admin\AppData\Local\Temp\putrefactible
Size 28KB
SHA256 e9568dfcc89ef146bd39b058f00f517e2e38e6c1803a1789a42964a04d3ce447
MD5 987a31dbb537478869509651d0720053
SHA1 4724f7ee2b302fe63e3155b79dae2be49947694d
SHA512 273ea46b1e8a0ae39ed74d9c5a7dc01a2d0626df844c8825b1f6ddf9ae079b411473092e9946568fc2c4f2a7c5dfe0dce43b735a2490d3a2030fd16784797a9a
SSDEEP 768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbX+IZ6Gg4vfF3if6gyHI:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1896-103-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-95-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-60-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1896-61-0x0000000002D80000-0x0000000002DD4000-memory.dmp

Download

memory/1896-62-0x0000000005AB0000-0x0000000006054000-memory.dmp

Download

memory/1896-63-0x0000000005450000-0x00000000054A2000-memory.dmp

Download

memory/1896-69-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-79-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-125-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-123-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-121-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-119-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-117-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-113-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-109-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-107-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-105-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-1097-0x00000000069F0000-0x00000000069FA000-memory.dmp

Download

memory/1896-101-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-99-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-97-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-59-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/1896-91-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-89-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-88-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-85-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-83-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-82-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-77-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-75-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-73-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-72-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-115-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-111-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-93-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-67-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-65-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-64-0x0000000005450000-0x000000000549D000-memory.dmp

Download

memory/1896-1094-0x0000000005670000-0x00000000056D6000-memory.dmp

Download

memory/1896-1095-0x0000000006990000-0x00000000069E0000-memory.dmp

Download

memory/1896-1096-0x0000000006A80000-0x0000000006B12000-memory.dmp

Download

memory/4564-10-0x0000000000AD0000-0x0000000000AD4000-memory.dmp

Download