agenttesla | d09cae82231e8bb39eb676c09e80c9ad8ee44e2cb6dc0ed505e3a3855efeb400

Analysis

max time kernel
94s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_JULQTRA071244úPDF.scr.exe
Size

390KB
MD5

6d45f82383d6da5ca15af6d8b6ddb412
SHA1

30e3d33eca039badc0b2add6b5599199d311745b
SHA256

d09cae82231e8bb39eb676c09e80c9ad8ee44e2cb6dc0ed505e3a3855efeb400
SHA512

67d45d5bb8d6a861a2ad1efc8b184cb56ba722baf89a48b8ab0b896dfcdb5f9910ed359c4afe94794b111eb26babb7ebb12e2a68ede41c95180c46f045ead421
SSDEEP

1536:pMhZVC0FEvOUx59vYTGP6mrql/NhuCtG9Q7qPpqOLy0uyL+fR:pMhqv9vYTGPDOx6H+Yuy0

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
investms.vadavo.cloud
Port:
587
Username:
[email protected]
Password:
emp@GnVg+%sS},OW
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	api.ipify.org
39	api.ipify.org
40	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3736	aspnet_compiler.exe
3736	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	QUOTATION_JULQTRA071244úPDF.scr.exe
Token: SeDebugPrivilege	3012	QUOTATION_JULQTRA071244úPDF.scr.exe
Token: SeDebugPrivilege	3736	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3736	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90
PID 3012 wrote to memory of 3736	3012	QUOTATION_JULQTRA071244úPDF.scr.exe	90

C:\Users\Admin\AppData\Local\Temp\QUOTATION_JULQTRA071244úPDF.scr.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_JULQTRA071244úPDF.scr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3012-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000220000-0x0000000000286000-memory.dmp

Filesize
408KB

Download
memory/3012-2-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3012-3-0x0000000005F00000-0x000000000612E000-memory.dmp

Filesize
2.2MB

Download
memory/3012-9-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-11-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-41-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-51-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-63-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-67-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-65-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-61-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-59-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-57-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-55-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-53-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-49-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-47-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-45-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-43-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-39-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-37-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-35-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-33-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-29-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-27-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-31-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-25-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-21-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-19-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-17-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-15-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-13-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-23-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-7-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-5-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-4-0x0000000005F00000-0x0000000006129000-memory.dmp

Filesize
2.2MB

Download
memory/3012-4866-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3012-4868-0x0000000005550000-0x000000000559C000-memory.dmp

Filesize
304KB

Download
memory/3012-4867-0x00000000054E0000-0x000000000554C000-memory.dmp

Filesize
432KB

Download
memory/3012-4869-0x00000000059C0000-0x0000000005A52000-memory.dmp

Filesize
584KB

Download
memory/3012-4870-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Filesize
408KB

Download
memory/3012-4871-0x00000000069B0000-0x0000000006F54000-memory.dmp

Filesize
5.6MB

Download
memory/3012-4872-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

Filesize
4KB

Download
memory/3012-4873-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3012-4874-0x0000000000360000-0x00000000003B4000-memory.dmp

Filesize
336KB

Download
memory/3012-4877-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3736-4878-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3736-4879-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3736-4880-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3736-4881-0x00000000066A0000-0x00000000066F0000-memory.dmp

Filesize
320KB

Download
memory/3736-4882-0x0000000006750000-0x000000000675A000-memory.dmp

Filesize
40KB

Download
memory/3736-4883-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download