agenttesla | 03665ef38e9753bab4a9f071bfd6fb52426fa14dbe9d55f019b7cead8bcbacfb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42.exe
Size 1.1MB
Sample240703-jfs41stalb
SHA256 03665ef38e9753bab4a9f071bfd6fb52426fa14dbe9d55f019b7cead8bcbacfb
MD5 cb5a596f6ae023f22312ac155b442817
SHA1 3bbc4dcd644056c062dc4f3e9bdb0ac93dd372ab
SHA512 6ef7537f5173fe1f501f0a273534f6ba2f840a8e85242420e58d55962598d88d12db545baaa4d8fdc062286fcfae28b8a7aafb43b3d9bed517e8d46424bb01c6
SSDEEP 24576:5AHnh+eWsN3skA4RV1Hom2KXMmHa9Ts7q0U/mV3Uv/35:Ah+ZkldoPK8Ya9o7ruVZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.funworld.co.id
Port
587
Username
[email protected]
Password
fwp123mail
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3912 set thread context of 2884	3912	42.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5068	3912	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	RegSvcs.exe
2884	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3912	42.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3912	42.exe
3912	42.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3912	42.exe
3912	42.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2884	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2884	3912	42.exe	87
PID 3912 wrote to memory of 2884	3912	42.exe	87
PID 3912 wrote to memory of 2884	3912	42.exe	87
PID 3912 wrote to memory of 2884	3912	42.exe	87

C:\Users\Admin\AppData\Local\Temp\42.exe
"C:\Users\Admin\AppData\Local\Temp\42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\42.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 696
  2⤵
  - Program crash
  PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3912 -ip 3912
1⤵
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2884-11-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2884-12-0x000000007425E000-0x000000007425F000-memory.dmp

Download

memory/2884-13-0x00000000054D0000-0x0000000005A74000-memory.dmp

Download

memory/2884-14-0x0000000004F90000-0x0000000004FF6000-memory.dmp

Download

memory/2884-15-0x0000000074250000-0x0000000074A00000-memory.dmp

Download

memory/2884-16-0x0000000005D30000-0x0000000005D80000-memory.dmp

Download

memory/2884-17-0x0000000005E20000-0x0000000005EB2000-memory.dmp

Download

memory/2884-18-0x0000000005FD0000-0x0000000005FDA000-memory.dmp

Download

memory/2884-19-0x000000007425E000-0x000000007425F000-memory.dmp

Download

memory/2884-20-0x0000000074250000-0x0000000074A00000-memory.dmp

Download

memory/3912-10-0x00000000024B0000-0x00000000024B4000-memory.dmp

Download