agenttesla | 5278c1cfb1c0d36ae3484bce29c553a603b23acb906b64e961f2341e4d84af04

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
M0000B Requisition form.pdf.exe
Size 2.8MB
Sample240616-bmc3datamb
SHA256 2a6afc17b2774e4f93c5e56b5cdd783eb6d934b94d6991e33b2b9eaeabd69d1c
MD5 2b3b5142794c20f4193298fde9e6a188
SHA1 862b5e5c004e77d542e0ebe81e053278273ea439
SHA512 4065618d39908987bc9efb8d9c6a3bde6dfcdcd3768f119057761dc88bef9d266f30d827996e8d856bca123d881548da49a1339952f5721650b8a228f57a730d
SSDEEP 49152:ugpOmgDQ06m3N051GXdJCXw5Y9eh8wM1A8MfwostVPwZD:YDDe4RhUHfP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
ozenmobilya.com
Port
587
Username
[email protected]
Password
ozennefes
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1844 set thread context of 2100	1844	M0000B Requisition form.pdf.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	AddInProcess32.exe
2100	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29
PID 1844 wrote to memory of 2100	1844	M0000B Requisition form.pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\M0000B Requisition form.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\M0000B Requisition form.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2100-4-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2100-2-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2100-5-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Download

memory/2100-6-0x0000000073FA0000-0x000000007468E000-memory.dmp

Download

memory/2100-7-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Download

memory/2100-8-0x0000000073FA0000-0x000000007468E000-memory.dmp

Download