agenttesla | 904b8e3088d91ab3b5c0929d7bf5b8fe47d11a481e72a9a7084bb6d07b014169

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 05:01

Target

Quotation.exe
Size

1.8MB
MD5

cfa9388561f27c724138310aa179a19f
SHA1

31ce3fd41182c65907ee64186875ffc76c23ef13
SHA256

904b8e3088d91ab3b5c0929d7bf5b8fe47d11a481e72a9a7084bb6d07b014169
SHA512

2dc2f9670be28b10a7d61e5c7051f7b3c890c1f7bccff61051a2c8d91b420f34cec6138e426782be61f58b447288df41615ec2756d9e6efea39a6a2a40566472
SSDEEP

49152:1OD+bTI6YTDml4HJPHDQkOBU0f9iygcrxZ3aU5ZxIrRo2ht1N1evkhfRG0KZ+:sv85YZBS

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2196 set thread context of 2424	2196	Quotation.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	jsc.exe
2424	jsc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	jsc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2004	2196	Quotation.exe	29
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30
PID 2196 wrote to memory of 2424	2196	Quotation.exe	30

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:2004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2424

memory/2424-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2424-4-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2424-3-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2424-5-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/2424-6-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download
memory/2424-7-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/2424-8-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Filesize
6.9MB

Download