agenttesla | 2eee8050f8bf737e67356837dedc9ccd415011df20ed2b14f6743ecbf265d3d1

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
42.exe
Size 1.0MB
Sample240705-tmcqqatepc
SHA256 2eee8050f8bf737e67356837dedc9ccd415011df20ed2b14f6743ecbf265d3d1
MD5 08b7a62938d3de352f0eb556fb046303
SHA1 b9c814281ae2c5f0d86ea72c7370034dd992c7db
SHA512 b365076b2d751f718bfd261fc2c3ac19c026b720858d7f064f8df5503c3ffb839385f883e7f77a84f7ef5b7a54e96dd53084c6fdcbb5270e790751ec6dc85de9
SSDEEP 24576:GAHnh+eWsN3skA4RV1Hom2KXMmHa+7kPgeBXY5:hh+ZkldoPK8Ya+7kxBu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.funworld.co.id
Port
587
Username
[email protected]
Password
fwp123mail
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 2636	2232	42.exe	91

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4692	2232	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2636	RegSvcs.exe
2636	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2232	42.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2232	42.exe
2232	42.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2232	42.exe
2232	42.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2636	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2636	2232	42.exe	91
PID 2232 wrote to memory of 2636	2232	42.exe	91
PID 2232 wrote to memory of 2636	2232	42.exe	91
PID 2232 wrote to memory of 2636	2232	42.exe	91

C:\Users\Admin\AppData\Local\Temp\42.exe
"C:\Users\Admin\AppData\Local\Temp\42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\42.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 696
  2⤵
  - Program crash
  PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2232 -ip 2232
1⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1280,i,4226873509039249198,15952596839998010243,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
1⤵
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-10-0x0000000001000000-0x0000000001004000-memory.dmp

Download

memory/2636-11-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2636-12-0x000000007424E000-0x000000007424F000-memory.dmp

Download

memory/2636-13-0x00000000059E0000-0x0000000005F84000-memory.dmp

Download

memory/2636-14-0x0000000002F40000-0x0000000002FA6000-memory.dmp

Download

memory/2636-15-0x0000000074240000-0x00000000749F0000-memory.dmp

Download

memory/2636-16-0x0000000006190000-0x00000000061E0000-memory.dmp

Download

memory/2636-17-0x0000000006280000-0x0000000006312000-memory.dmp

Download

memory/2636-18-0x0000000006260000-0x000000000626A000-memory.dmp

Download

memory/2636-19-0x000000007424E000-0x000000007424F000-memory.dmp

Download

memory/2636-20-0x0000000074240000-0x00000000749F0000-memory.dmp

Download