agenttesla | e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:30

Target

e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe
Size

341KB
MD5

6999ec10578f5faebb2ee27471a9c967
SHA1

7e4e105899cd8f30a3c5e8ef6815c9dbb1581e18
SHA256

e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e
SHA512

b4ca16c180193a143f95e7e82c7f7ca4f67c3bb71049bb0f8aa18cf75863fc0ae8bbe0decbef77db44b64bb46a4b2a3f5ffa0d112a7fb679042a166dbe2da999
SSDEEP

3072:ApHzGkko4HmJo5LfN3OFI8ryG3Hr9ilNMz1grh/6qvUVEw3gSWo8siofh/:ApHVceI8OG7jxEvU9Qt1s

Score

10^/10

Family

agenttesla

https://api.telegram.org/bot6401060771:AAF8rHCQk-o-9VI7BrWiQ98NUEGXRg9k85o/

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
11	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe
2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe
3200	InstallUtil.exe
3200	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe
Token: SeDebugPrivilege	3200	InstallUtil.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3200	InstallUtil.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2512	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	83
PID 2736 wrote to memory of 2512	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	83
PID 2736 wrote to memory of 2512	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	83
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84
PID 2736 wrote to memory of 3200	2736	e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe	84

C:\Users\Admin\AppData\Local\Temp\e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe
"C:\Users\Admin\AppData\Local\Temp\e8ae346ea2979c546ac9e45804c6a6e5c22c8dc106046c24c91c9a63a167283e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3200

memory/2736-6-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2736-1-0x00000000005D0000-0x000000000062A000-memory.dmp

Filesize
360KB

Download
memory/2736-2-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2736-3-0x0000000006290000-0x000000000629A000-memory.dmp

Filesize
40KB

Download
memory/2736-0-0x000000007450E000-0x000000007450F000-memory.dmp

Filesize
4KB

Download
memory/3200-7-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/3200-4-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3200-8-0x0000000005740000-0x0000000005CE4000-memory.dmp

Filesize
5.6MB

Download
memory/3200-9-0x0000000005290000-0x00000000052F6000-memory.dmp

Filesize
408KB

Download
memory/3200-10-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/3200-11-0x00000000066C0000-0x0000000006710000-memory.dmp

Filesize
320KB

Download
memory/3200-12-0x00000000067B0000-0x000000000684C000-memory.dmp

Filesize
624KB

Download
memory/3200-13-0x0000000006850000-0x00000000068E2000-memory.dmp

Filesize
584KB

Download
memory/3200-14-0x0000000006A10000-0x0000000006A1A000-memory.dmp

Filesize
40KB

Download
memory/3200-15-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download