agenttesla | 2eee8050f8bf737e67356837dedc9ccd415011df20ed2b14f6743ecbf265d3d1

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42.exe
Size 1.0MB
Sample240705-tmcqqatepc
SHA256 2eee8050f8bf737e67356837dedc9ccd415011df20ed2b14f6743ecbf265d3d1
MD5 08b7a62938d3de352f0eb556fb046303
SHA1 b9c814281ae2c5f0d86ea72c7370034dd992c7db
SHA512 b365076b2d751f718bfd261fc2c3ac19c026b720858d7f064f8df5503c3ffb839385f883e7f77a84f7ef5b7a54e96dd53084c6fdcbb5270e790751ec6dc85de9
SSDEEP 24576:GAHnh+eWsN3skA4RV1Hom2KXMmHa+7kPgeBXY5:hh+ZkldoPK8Ya+7kxBu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.funworld.co.id
Port
587
Username
[email protected]
Password
fwp123mail
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 2208	2868	42.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2208	RegSvcs.exe
2208	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2868	42.exe
2868	42.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2868	42.exe
2868	42.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2868	42.exe
2868	42.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2208	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2208	2868	42.exe	28
PID 2868 wrote to memory of 2208	2868	42.exe	28
PID 2868 wrote to memory of 2208	2868	42.exe	28
PID 2868 wrote to memory of 2208	2868	42.exe	28
PID 2868 wrote to memory of 2208	2868	42.exe	28
PID 2868 wrote to memory of 2208	2868	42.exe	28
PID 2868 wrote to memory of 2208	2868	42.exe	28
PID 2868 wrote to memory of 2208	2868	42.exe	28

C:\Users\Admin\AppData\Local\Temp\42.exe
"C:\Users\Admin\AppData\Local\Temp\42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\42.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-11-0x0000000000090000-0x00000000000D0000-memory.dmp

Download

memory/2208-17-0x0000000000090000-0x00000000000D0000-memory.dmp

Download

memory/2208-14-0x0000000000090000-0x00000000000D0000-memory.dmp

Download

memory/2208-20-0x0000000000090000-0x00000000000D0000-memory.dmp

Download

memory/2208-21-0x000000007428E000-0x000000007428F000-memory.dmp

Download

memory/2208-22-0x0000000074280000-0x000000007496E000-memory.dmp

Download

memory/2208-23-0x000000007428E000-0x000000007428F000-memory.dmp

Download

memory/2208-24-0x0000000074280000-0x000000007496E000-memory.dmp

Download

memory/2868-10-0x0000000000120000-0x0000000000124000-memory.dmp

Download