agenttesla | 697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe
Size 607KB
Sample240616-bd3axaseqe
SHA256 697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0
MD5 694dcf95070dc0954d8219ac251a58af
SHA1 4bb3a962ef5ce7d9b0dbf39dcbc27d93248d7274
SHA512 d23628661710faac0bdf07d542fda42f118307fb9cc88d4d54c05a0f0dc5f9a4ada79354b4dad6506faa92708a59f9b7a9bd49a03ba7e7b53caeb93caf4125d1
SSDEEP 12288:um4mfwt3/hTMzXeiurSIdMQ5m00oSnsTpITH2dOHyzuL6Hz:mazzXZp0ZpApHSuLOz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.amacoqatar.net
Port
587
Username
[email protected]
Password
Abdulaziz@amo100 . ,

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.amacoqatar.net
Port
587
Username
[email protected]
Password
Abdulaziz@amo100 . ,
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	installutil.exe
1512	installutil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe
Token: SeDebugPrivilege	1512	installutil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1512	installutil.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1512	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	86
PID 1640 wrote to memory of 1664	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	87
PID 1640 wrote to memory of 1664	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	87
PID 1640 wrote to memory of 1664	1640	697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe	87

C:\Users\Admin\AppData\Local\Temp\697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe
"C:\Users\Admin\AppData\Local\Temp\697405a4b420e763880c8834c02e9398dba4fc707626754d0e81429d4e9f34c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
  2⤵
  PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-12-0x00000000083F0000-0x0000000008440000-memory.dmp

Download

memory/1512-9-0x0000000075070000-0x0000000075820000-memory.dmp

Download

memory/1512-16-0x0000000075070000-0x0000000075820000-memory.dmp

Download

memory/1512-15-0x000000007507E000-0x000000007507F000-memory.dmp

Download

memory/1512-14-0x00000000087C0000-0x00000000087CA000-memory.dmp

Download

memory/1512-5-0x0000000000400000-0x0000000000444000-memory.dmp

Download

memory/1512-6-0x000000007507E000-0x000000007507F000-memory.dmp

Download

memory/1512-7-0x00000000059C0000-0x0000000005F64000-memory.dmp

Download

memory/1512-13-0x00000000084E0000-0x000000000857C000-memory.dmp

Download

memory/1512-11-0x0000000006350000-0x00000000063E2000-memory.dmp

Download

memory/1512-8-0x0000000005480000-0x00000000054E6000-memory.dmp

Download

memory/1640-10-0x00007FFB65F30000-0x00007FFB669F1000-memory.dmp

Download

memory/1640-0-0x0000020708330000-0x000002070833A000-memory.dmp

Download

memory/1640-1-0x00007FFB65F33000-0x00007FFB65F35000-memory.dmp

Download

memory/1640-4-0x0000020723170000-0x0000020723206000-memory.dmp

Download

memory/1640-3-0x0000020709EF0000-0x0000020709EF6000-memory.dmp

Download

memory/1640-2-0x00007FFB65F30000-0x00007FFB669F1000-memory.dmp

Download