agenttesla | c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe
Size 2.4MB
Sample240615-b14ggsvbme
SHA256 c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963
MD5 ad57472f98fd90f9d8ea50b81fdc9ca3
SHA1 f8e5df1f28cc248a7e9db513b0190eb89e404ea0
SHA512 d8059ad0108fc54dde5b13edbd3b674c7d6f157ea762ca0897bd76f558501b003b45615018dbd4d7164f43bdb55520d662e0c537258a448783f30c5bc2f5bd6c
SSDEEP 12288:g0pUBSN9+NsidyZENv9aPIk2QP3S42w997kzj68xYeg1sgybjSFgz:g0OkN9wsig6iwkBPC42wAiesybjSaz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.ionos.com
Port
587
Username
[email protected]
Password
T2@Gwt567
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1892 set thread context of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2960	installutil.exe
2960	installutil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	installutil.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2960	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	29
PID 1892 wrote to memory of 2588	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	30
PID 1892 wrote to memory of 2588	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	30
PID 1892 wrote to memory of 2588	1892	c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe	30

C:\Users\Admin\AppData\Local\Temp\c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe
"C:\Users\Admin\AppData\Local\Temp\c028d3601c3a33215a228fa454cb111bf56cd485ab3aaa1bea7aef8650aa1963.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1892 -s 656
  2⤵
  PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-0-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Download

memory/1892-1-0x0000000000C90000-0x0000000000CA0000-memory.dmp

Download

memory/1892-2-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Download

memory/1892-3-0x0000000000AA0000-0x0000000000B34000-memory.dmp

Download

memory/1892-21-0x000007FEF5800000-0x000007FEF61EC000-memory.dmp

Download

memory/1892-20-0x000007FEF5803000-0x000007FEF5804000-memory.dmp

Download

memory/2960-13-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2960-15-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2960-17-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2960-10-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2960-8-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2960-4-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2960-18-0x000000007450E000-0x000000007450F000-memory.dmp

Download

memory/2960-19-0x0000000074500000-0x0000000074BEE000-memory.dmp

Download

memory/2960-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2960-6-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2960-22-0x000000007450E000-0x000000007450F000-memory.dmp

Download

memory/2960-23-0x0000000074500000-0x0000000074BEE000-memory.dmp

Download