agenttesla | a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe
Size 3.3MB
Sample240615-byq4davanc
SHA256 a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697
MD5 f35dc30abc8b3b84750fc5b10f73d9ca
SHA1 90198eec7dde3580fc4db30ce6e0d429212ed8d9
SHA512 9bff51475efb532184a90e52f725ed0fc5f8f9c3814f764759128d45390be0bdb7198aec9cde75772116d74ebd309e1c7ce73648c13d037e39fecb134817593d
SSDEEP 12288:GLyXEi9rx+d4aK01YtPKJWEjj+PF5LrKmEA5LGVuXN7H08s5Pc3:rXEqV+d4aK01YRKLjjWHrKmESNw8YPi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
cphost09.qhoster.net
Port
587
Username
[email protected]
Password
Emotion!22
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
368	4184	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	CasPol.exe
4184	CasPol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	CasPol.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 4184	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	84
PID 1608 wrote to memory of 5084	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	85
PID 1608 wrote to memory of 5084	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	85
PID 1608 wrote to memory of 5084	1608	a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe	85

C:\Users\Admin\AppData\Local\Temp\a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe
"C:\Users\Admin\AppData\Local\Temp\a9581804824f516325c315ff6dff463aa26c5a3772b20ea024995f935457d697.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 1936
    3⤵
    - Program crash
    PID:368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4184 -ip 4184
1⤵
PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-0-0x00007FFBF7F63000-0x00007FFBF7F65000-memory.dmp

Download

memory/1608-1-0x0000023D35380000-0x0000023D3538E000-memory.dmp

Download

memory/1608-2-0x00007FFBF7F60000-0x00007FFBF8A21000-memory.dmp

Download

memory/1608-3-0x0000023D4F9D0000-0x0000023D4FA64000-memory.dmp

Download

memory/1608-9-0x00007FFBF7F60000-0x00007FFBF8A21000-memory.dmp

Download

memory/4184-4-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4184-5-0x000000007515E000-0x000000007515F000-memory.dmp

Download

memory/4184-6-0x0000000005CD0000-0x0000000006274000-memory.dmp

Download

memory/4184-7-0x0000000005820000-0x0000000005886000-memory.dmp

Download

memory/4184-8-0x0000000075150000-0x0000000075900000-memory.dmp

Download

memory/4184-10-0x0000000075150000-0x0000000075900000-memory.dmp

Download