agenttesla | 1e1da377c0f41372c1c2451bfdd3190a585b26de3e6a5e183d736ce63dff6e20

Analysis

max time kernel
93s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TransferpaymentCopy.exe
Size

709KB
MD5

8593d8eb9658e9df45ff65bd26ca94bd
SHA1

98fe2399a24f8dbe4854c399bf56e715b6f0adb0
SHA256

ac6339d009707c84feb93057d1aac7862e29e65fe8d3827def360312c3072988
SHA512

90009ca966c4fa702e87ab29e4ccd02834a8ee94805af265192b3bc92c84766b74e2f2c204fcf6adf7c9372f9971024cd15e02440102b91121fa86c6ceaeedcc
SSDEEP

12288:+9Pm26Ck/cCyLByjh8Y16xh/giGAZIMHFzT3YI5:DrqcWYWZzlP3

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://wenhuahui.net.au
Port:
21
Username:
[email protected]
Password:
F4~nmTqWy?%x

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2068 set thread context of 1500	2068	TransferpaymentCopy.exe	93

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2068	TransferpaymentCopy.exe
2068	TransferpaymentCopy.exe
2068	TransferpaymentCopy.exe
2068	TransferpaymentCopy.exe
1500	InstallUtil.exe
1500	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	TransferpaymentCopy.exe
Token: SeDebugPrivilege	1500	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93
PID 2068 wrote to memory of 1500	2068	TransferpaymentCopy.exe	93

C:\Users\Admin\AppData\Local\Temp\TransferpaymentCopy.exe
"C:\Users\Admin\AppData\Local\Temp\TransferpaymentCopy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1500-13-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1500-20-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/1500-19-0x0000000008B60000-0x0000000008BB0000-memory.dmp

Filesize
320KB

Download
memory/1500-18-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/1500-17-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/1500-16-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/2068-5-0x00000000053A0000-0x0000000005944000-memory.dmp

Filesize
5.6MB

Download
memory/2068-6-0x0000000004E90000-0x0000000004F22000-memory.dmp

Filesize
584KB

Download
memory/2068-8-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/2068-9-0x00000000744CE000-0x00000000744CF000-memory.dmp

Filesize
4KB

Download
memory/2068-10-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/2068-11-0x00000000061C0000-0x00000000061DA000-memory.dmp

Filesize
104KB

Download
memory/2068-12-0x0000000005390000-0x0000000005396000-memory.dmp

Filesize
24KB

Download
memory/2068-7-0x0000000005020000-0x000000000502A000-memory.dmp

Filesize
40KB

Download
memory/2068-15-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/2068-0-0x00000000744CE000-0x00000000744CF000-memory.dmp

Filesize
4KB

Download
memory/2068-4-0x0000000004AB0000-0x0000000004AF4000-memory.dmp

Filesize
272KB

Download
memory/2068-3-0x00000000744C0000-0x0000000074C70000-memory.dmp

Filesize
7.7MB

Download
memory/2068-2-0x0000000004B50000-0x0000000004BEC000-memory.dmp

Filesize
624KB

Download
memory/2068-1-0x0000000000270000-0x0000000000328000-memory.dmp

Filesize
736KB

Download