agenttesla | 26eb00443d0e6dc3d23b93a849f258fea9d6e1407d4f028a351087f1adba276c

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hesaphareketi-01.pdf.exe
Size 2.8MB
Sample240615-bheemsxdrm
SHA256 1c81c786a70496397e5c05b533473585322037875390aa522f8ffed43bf47c84
MD5 6ef300bfb675f9f43ce9751bcde636a7
SHA1 a689883c5be34d8af57336b8307bca8948193206
SHA512 dc92f1f0bdafa0c8ba37e88703c1544cc418ddee6a92e73adb36dffd125da78b3e68d525b4dce2f345138cd2b9a257e5a3e5156747d4567226db0f91ce1bd33f
SSDEEP 49152:SgpOmgDQ06m3N051GXdJCXw5Y9ehHwM1A8EfwosEm:MDDe4RhJHE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
ozenmobilya.com
Port
587
Username
[email protected]
Password
ozennefes
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4712 set thread context of 216	4712	hesaphareketi-01.pdf.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
216	CasPol.exe
216	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
216	CasPol.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86
PID 4712 wrote to memory of 216	4712	hesaphareketi-01.pdf.exe	86

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/216-1-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Download

memory/216-2-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Download

memory/216-3-0x0000000005550000-0x00000000055B6000-memory.dmp

Download

memory/216-4-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/216-5-0x0000000006AE0000-0x0000000006B30000-memory.dmp

Download

memory/216-6-0x0000000006BD0000-0x0000000006C6C000-memory.dmp

Download

memory/216-7-0x0000000074EEE000-0x0000000074EEF000-memory.dmp

Download

memory/216-8-0x0000000074EE0000-0x0000000075690000-memory.dmp

Download

memory/216-9-0x0000000006C70000-0x0000000006D02000-memory.dmp

Download

memory/216-10-0x0000000006BB0000-0x0000000006BBA000-memory.dmp

Download