agenttesla | a20de7e7bbef09ebed3d040adaa6c7c896129cbf3a2d2b0286e84490c57240a7

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ_372842754579.pdf.exe
Size 996KB
Sample240615-cdtt7svgnc
SHA256 a20de7e7bbef09ebed3d040adaa6c7c896129cbf3a2d2b0286e84490c57240a7
MD5 c3777e495958d906c0272854efa1f839
SHA1 2ce114d84e22839f13e4100380d89641ed536dc2
SHA512 21f359012861caf497d504bfd3276596d2956ac85469d4ca653b163e4f70c042d1e157800476d44b2254f85f1535cfe2195b3dd7ba29dba28b6dc551014efe7c
SSDEEP 12288:xIMnNVezA31MA8ohdXY5+VXRN+Gkcj0f62q58Q3pUewZBsUyAessQZ:xIMnN+Aj8l+bK3f6l58HZ5yrQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.aluminumsheet.mx
Port
587
Username
[email protected]
Password
WORTHwill3611!! ,
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1332 set thread context of 100	1332	RFQ_372842754579.pdf.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
100	installutil.exe
100	installutil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	100	installutil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
100	installutil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85
PID 1332 wrote to memory of 100	1332	RFQ_372842754579.pdf.exe	85

C:\Users\Admin\AppData\Local\Temp\RFQ_372842754579.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_372842754579.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/100-8-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/100-10-0x0000000006020000-0x00000000060B2000-memory.dmp

Download

memory/100-15-0x00000000748E0000-0x0000000075090000-memory.dmp

Download

memory/100-14-0x00000000748EE000-0x00000000748EF000-memory.dmp

Download

memory/100-4-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/100-5-0x00000000748EE000-0x00000000748EF000-memory.dmp

Download

memory/100-13-0x0000000006360000-0x000000000636A000-memory.dmp

Download

memory/100-12-0x0000000006380000-0x000000000641C000-memory.dmp

Download

memory/100-11-0x0000000006290000-0x00000000062E0000-memory.dmp

Download

memory/100-7-0x0000000005220000-0x0000000005286000-memory.dmp

Download

memory/100-6-0x00000000057D0000-0x0000000005D74000-memory.dmp

Download

memory/1332-1-0x000001DA6A290000-0x000001DA6A2A0000-memory.dmp

Download

memory/1332-9-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmp

Download

memory/1332-0-0x00007FFDB7283000-0x00007FFDB7285000-memory.dmp

Download

memory/1332-3-0x000001DA6BFB0000-0x000001DA6C046000-memory.dmp

Download

memory/1332-2-0x00007FFDB7280000-0x00007FFDB7D41000-memory.dmp

Download