agenttesla | ae5e7576e3e268c5d301cd653b540412fca6e6b5a5f8efc611a995fc36933510

Analysis

max time kernel
104s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
M0000B Requisition form.pdf.exe
Size 2.8MB
Sample240616-bp2hratbpb
SHA256 117864e2e63bdafe3be560806bcc49c7701e524d173d867e0069cc2cc591692b
MD5 01d0fd052f583ddee7c23860d437fa0e
SHA1 0c027385b3a87cb2d2ae63a199e00ee468623d8e
SHA512 452279616d17d9ac430ca98607cc15cc65f4b8489dc4f4d4eb160f76afacf230602cb6c14fee6915b5aca5363b24564403c67b10df8b5788a9f16b2213dff2ed
SSDEEP 49152:SgpOmgDQ06m3N051GXdJCXw5Y9ehawM1A8mfwosQWN1:MDDe4RhEHFD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol
smtp
Host
ozenmobilya.com
Port
587
Username
[email protected]
Password
ozennefes

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
ozenmobilya.com
Port
587
Username
[email protected]
Password
ozennefes
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org
17	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3560 set thread context of 4832	3560	M0000B Requisition form.pdf.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	jsc.exe
4832	jsc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	jsc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4832	jsc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3312	3560	M0000B Requisition form.pdf.exe	86
PID 3560 wrote to memory of 3312	3560	M0000B Requisition form.pdf.exe	86
PID 3560 wrote to memory of 3312	3560	M0000B Requisition form.pdf.exe	86
PID 3560 wrote to memory of 3312	3560	M0000B Requisition form.pdf.exe	86
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87
PID 3560 wrote to memory of 4832	3560	M0000B Requisition form.pdf.exe	87

C:\Users\Admin\AppData\Local\Temp\M0000B Requisition form.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\M0000B Requisition form.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:3312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4832-1-0x00000000750AE000-0x00000000750AF000-memory.dmp

Download

memory/4832-2-0x0000000005810000-0x0000000005DB4000-memory.dmp

Download

memory/4832-3-0x0000000005360000-0x00000000053C6000-memory.dmp

Download

memory/4832-4-0x00000000750A0000-0x0000000075850000-memory.dmp

Download

memory/4832-5-0x0000000006860000-0x00000000068B0000-memory.dmp

Download

memory/4832-6-0x0000000006950000-0x00000000069EC000-memory.dmp

Download

memory/4832-7-0x0000000006A90000-0x0000000006B22000-memory.dmp

Download

memory/4832-8-0x0000000006A10000-0x0000000006A1A000-memory.dmp

Download

memory/4832-9-0x00000000750AE000-0x00000000750AF000-memory.dmp

Download

memory/4832-10-0x00000000750A0000-0x0000000075850000-memory.dmp

Download