agenttesla | 1c9240b747d01e77bbd4cea63699992b29fc24581021c9fc2a96c75e9e60cc1f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ss.exe
Size 1.1MB
Sample240705-tmcqqatepd
SHA256 1c9240b747d01e77bbd4cea63699992b29fc24581021c9fc2a96c75e9e60cc1f
MD5 0f0e9f8c92dad0234f46e4429a31d28c
SHA1 6a8165afbc72cd6bb4f2524ac144e36a1ef4c509
SHA512 cb2062113e00b790c7c5c9a6be4edb8934e2eea583a7da45814749c5482159a8b87ba0befe999d1b33527d5f5c02078c08b17ee76fc6d50fdd8b86c15bb89970
SSDEEP 24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa54weKD5wy/8LL5:/h+ZkldoPK8Ya5beC5ZUh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.pgsu.co.id
Port
587
Username
[email protected]
Password
Vecls16@Vezs
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 1320	1168	ss.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1320	RegSvcs.exe
1320	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1168	ss.exe
1168	ss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1168	ss.exe
1168	ss.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1168	ss.exe
1168	ss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1320	1168	ss.exe	85
PID 1168 wrote to memory of 1320	1168	ss.exe	85
PID 1168 wrote to memory of 1320	1168	ss.exe	85
PID 1168 wrote to memory of 1320	1168	ss.exe	85

C:\Users\Admin\AppData\Local\Temp\ss.exe
"C:\Users\Admin\AppData\Local\Temp\ss.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\ss.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-10-0x00000000040E0000-0x00000000040E4000-memory.dmp

Download

memory/1320-11-0x0000000000580000-0x00000000005C0000-memory.dmp

Download

memory/1320-12-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Download

memory/1320-13-0x00000000050C0000-0x0000000005664000-memory.dmp

Download

memory/1320-14-0x0000000004C10000-0x0000000004C76000-memory.dmp

Download

memory/1320-15-0x0000000073F30000-0x00000000746E0000-memory.dmp

Download

memory/1320-16-0x0000000005AD0000-0x0000000005B20000-memory.dmp

Download

memory/1320-17-0x0000000005BC0000-0x0000000005C52000-memory.dmp

Download

memory/1320-18-0x0000000005D60000-0x0000000005D6A000-memory.dmp

Download

memory/1320-19-0x0000000073F3E000-0x0000000073F3F000-memory.dmp

Download

memory/1320-20-0x0000000073F30000-0x00000000746E0000-memory.dmp

Download