agenttesla | ffd4c1cd38f8d05ffc5ba76ff28e1992e26cc3001e79cbf03c77b46abf6df260

Analysis

max time kernel
104s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Payment_Adv.exe
Size

1.1MB
MD5

351f1b364d598d3d1074d4a8a6df9923
SHA1

4cb6d6a2f5ba364768c73ffabbcd78617f05775f
SHA256

c6f67fcb5429fe7f5b04e00b331a8120998e6b22dbe8d4eacfa7a32b0c970025
SHA512

b7382f298e3dd2416806376111656161494ba27edbb0ed4c4256feb5ea9d24ee4a70c66aff30bb629b07474d9ab77059ed9989a1f989d3eb042a555dc358b938
SSDEEP

24576:SAHnh+eWsN3skA4RV1Hom2KXMmHaJTO8LBu8bBPndy3VLb5:Vh+ZkldoPK8YaJRduqB/o3Vx

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.ipify.org
18	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 3596	4544	Payment_Adv.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3596	RegSvcs.exe
3596	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4544	Payment_Adv.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3596	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 3596	4544	Payment_Adv.exe	86
PID 4544 wrote to memory of 3596	4544	Payment_Adv.exe	86
PID 4544 wrote to memory of 3596	4544	Payment_Adv.exe	86
PID 4544 wrote to memory of 3596	4544	Payment_Adv.exe	86

C:\Users\Admin\AppData\Local\Temp\Payment_Adv.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Adv.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Payment_Adv.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3596-12-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3596-13-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3596-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3596-15-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/3596-16-0x0000000004FF0000-0x0000000005044000-memory.dmp

Filesize
336KB

Download
memory/3596-18-0x00000000056D0000-0x0000000005C74000-memory.dmp

Filesize
5.6MB

Download
memory/3596-17-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/3596-19-0x0000000005080000-0x00000000050D2000-memory.dmp

Filesize
328KB

Download
memory/3596-43-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-45-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-79-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-213-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/3596-77-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-75-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-71-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-69-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-67-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-65-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-64-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-61-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-59-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-57-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-55-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-53-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-51-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-49-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-47-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-41-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-39-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-37-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-35-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-33-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-31-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-29-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-27-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-25-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-23-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-21-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-160-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/3596-73-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-20-0x0000000005080000-0x00000000050CD000-memory.dmp

Filesize
308KB

Download
memory/3596-1052-0x0000000005290000-0x00000000052F6000-memory.dmp

Filesize
408KB

Download
memory/3596-1053-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/3596-1054-0x0000000006700000-0x0000000006750000-memory.dmp

Filesize
320KB

Download
memory/3596-1055-0x00000000067F0000-0x0000000006882000-memory.dmp

Filesize
584KB

Download
memory/3596-1056-0x0000000006760000-0x000000000676A000-memory.dmp

Filesize
40KB

Download
memory/3596-1057-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/3596-1058-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

Filesize
4KB

Download
memory/3596-1059-0x0000000074B80000-0x0000000075330000-memory.dmp

Filesize
7.7MB

Download
memory/4544-10-0x0000000001A10000-0x0000000001A14000-memory.dmp

Filesize
16KB

Download