agenttesla | 0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:22

Target

0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe
Size

1.1MB
MD5

4361072f736089c4e2c5b7a6b4083ccb
SHA1

3e3ea721cca3b00510b5b43e48214c8a47e0f9f9
SHA256

0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636
SHA512

dc4562c16c2873b9d7e7d229c13bf6e225e025ba4d8a3e664608c542c97473aa061d045608833b0854eb37f27673cc167af332204a5551e4ca58a9a28ff4df06
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHak3+H/xSPFvm5:gh+ZkldoPK8Yakg5aa

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.ipify.org
23	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 328 set thread context of 2844	328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	328	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2844	RegSvcs.exe
2844	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe
328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe
328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 2844	328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe	85
PID 328 wrote to memory of 2844	328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe	85
PID 328 wrote to memory of 2844	328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe	85
PID 328 wrote to memory of 2844	328	0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe	85

C:\Users\Admin\AppData\Local\Temp\0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe
"C:\Users\Admin\AppData\Local\Temp\0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\0152f354bb063c566b9725d0962832e5324922c1592870c8b5b25789ccf1d636.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 696
  2⤵
  - Program crash
  PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 328 -ip 328
1⤵
PID:1964

memory/328-10-0x00000000018E0000-0x00000000018E4000-memory.dmp

Filesize
16KB

Download
memory/2844-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2844-12-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2844-13-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/2844-14-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/2844-15-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/2844-16-0x0000000006DF0000-0x0000000006E40000-memory.dmp

Filesize
320KB

Download
memory/2844-17-0x0000000006EE0000-0x0000000006F72000-memory.dmp

Filesize
584KB

Download
memory/2844-18-0x0000000006E90000-0x0000000006E9A000-memory.dmp

Filesize
40KB

Download
memory/2844-19-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2844-20-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download