agenttesla | 52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe
Size 1.8MB
Sample240620-blcefsvejq
SHA256 52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba
MD5 ef1c9217fa43d2266209ce6bc6eabb81
SHA1 ff2bfda2b16e52e63ebc36b0e44a7a1c6214060a
SHA512 7d1507e53fb11fe096bbd1a5d108100ca39aaa58585e8456685a9754c3775fd6468031de2ba51da804f72ed0d443f10aee731bf793e0096b40c8dd7e25a893ea
SSDEEP 49152:s01xRoq0SqdSo1s9Z7N/pilLbWQ87oFfXUiUbL1tPGIixZNJ:Snd9UufNJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.blancahotel.com
Port
587
Username
[email protected]
Password
J4OsTW6J
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	AddInProcess32.exe
2832	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2832	AddInProcess32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86
PID 220 wrote to memory of 2832	220	52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe	86

C:\Users\Admin\AppData\Local\Temp\52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe
"C:\Users\Admin\AppData\Local\Temp\52ac175362880bf7cf11449073dd450303dcee4e8fc39ee0541185ffd8e0e5ba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-0-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2832-1-0x0000000074E1E000-0x0000000074E1F000-memory.dmp

Download

memory/2832-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

Download

memory/2832-3-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/2832-4-0x0000000074E10000-0x00000000755C0000-memory.dmp

Download

memory/2832-5-0x0000000006780000-0x00000000067D0000-memory.dmp

Download

memory/2832-6-0x0000000006870000-0x0000000006902000-memory.dmp

Download

memory/2832-7-0x0000000006A10000-0x0000000006A1A000-memory.dmp

Download

memory/2832-8-0x0000000074E1E000-0x0000000074E1F000-memory.dmp

Download

memory/2832-9-0x0000000074E10000-0x00000000755C0000-memory.dmp

Download