agenttesla | ba38ba94dc7746ab451cb686df8d8f4cec03db581ae095c5e1b959134db30daa

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:17

Target

ss.exe
Size

1.1MB
MD5

5693d8863209b5498ff1a61caebfa9ba
SHA1

abd83adb9fc5495034accb251a4b1e04f47e1b3d
SHA256

ba38ba94dc7746ab451cb686df8d8f4cec03db581ae095c5e1b959134db30daa
SHA512

efbb0d585641cd85e71ef5fe08be05accd343b636deed64c2fca5075aafbada439f511fe1a4bea22c3f43f4e9c10ea273abfb9103c6c4f0dd8a50284b6b78c82
SSDEEP

24576:eAHnh+eWsN3skA4RV1Hom2KXMmHa3W9G2Qu2HUI+VV+BKI5:Jh+ZkldoPK8Ya3WTKHUI3N

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 2536	4940	ss.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	4940	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2536	RegSvcs.exe
2536	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4940	ss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2536	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4940	ss.exe
4940	ss.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4940	ss.exe
4940	ss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2536	4940	ss.exe	86
PID 4940 wrote to memory of 2536	4940	ss.exe	86
PID 4940 wrote to memory of 2536	4940	ss.exe	86
PID 4940 wrote to memory of 2536	4940	ss.exe	86

C:\Users\Admin\AppData\Local\Temp\ss.exe
"C:\Users\Admin\AppData\Local\Temp\ss.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\ss.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 696
  2⤵
  - Program crash
  PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4940 -ip 4940
1⤵
PID:3996

memory/2536-11-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-12-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2536-13-0x0000000005CB0000-0x0000000006254000-memory.dmp

Filesize
5.6MB

Download
memory/2536-14-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/2536-15-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/2536-16-0x00000000066C0000-0x0000000006710000-memory.dmp

Filesize
320KB

Download
memory/2536-17-0x00000000067B0000-0x0000000006842000-memory.dmp

Filesize
584KB

Download
memory/2536-18-0x0000000006940000-0x000000000694A000-memory.dmp

Filesize
40KB

Download
memory/2536-19-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2536-20-0x0000000074280000-0x0000000074A30000-memory.dmp

Filesize
7.7MB

Download
memory/4940-10-0x0000000002220000-0x0000000002224000-memory.dmp

Filesize
16KB

Download