agenttesla | 3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602

Analysis

max time kernel
121s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe
Size

1.0MB
MD5

99af50ba5059f85a1c8bd15ecf23fb3b
SHA1

276b986f4a09fc2dd4df54df5ca32817096f1318
SHA256

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602
SHA512

60a1df813458faf865c4ee73d66f58d4dca9de8a52c6b35119a14da59e6d5e640fe6752ec2a8599bf3b960b0b6bf083f533b56601d804df14d77dcc98aa47801
SSDEEP

12288:PaCIgcZcoaREnONS7zCm4ry3tr/QUC7z46a3c:ygec+OeuO9r4UiO3c

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.fasmacopy.gr
Port:
587
Username:
[email protected]
Password:
Fam28sjd
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 api.ipify.org
19 api.ipify.org

flow	ioc
18	api.ipify.org
19	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe

description	pid	process	target process
PID 4060 set thread context of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

CasPol.exe

pid process

1484 CasPol.exe
1484 CasPol.exe

pid	process
1484	CasPol.exe
1484	CasPol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exeCasPol.exe

description	pid	process
Token: SeDebugPrivilege	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe
Token: SeDebugPrivilege	1484	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

CasPol.exe

pid process

1484 CasPol.exe

pid	process
1484	CasPol.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe

description	pid	process	target process
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 1484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 4484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 4484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe
PID 4060 wrote to memory of 4484	4060	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	CasPol.exe

C:\Users\Admin\AppData\Local\Temp\3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe
"C:\Users\Admin\AppData\Local\Temp\3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
2⤵
PID:4484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1484-11-0x00000000064F0000-0x0000000006540000-memory.dmp

Filesize
320KB

Download
memory/1484-16-0x00000000066C0000-0x00000000066CA000-memory.dmp

Filesize
40KB

Download
memory/1484-15-0x0000000006720000-0x00000000067B2000-memory.dmp

Filesize
584KB

Download
memory/1484-14-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/1484-13-0x000000007519E000-0x000000007519F000-memory.dmp

Filesize
4KB

Download
memory/1484-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1484-6-0x000000007519E000-0x000000007519F000-memory.dmp

Filesize
4KB

Download
memory/1484-7-0x0000000005530000-0x0000000005AD4000-memory.dmp

Filesize
5.6MB

Download
memory/1484-12-0x00000000065E0000-0x000000000667C000-memory.dmp

Filesize
624KB

Download
memory/1484-9-0x0000000075190000-0x0000000075940000-memory.dmp

Filesize
7.7MB

Download
memory/1484-10-0x0000000005100000-0x0000000005166000-memory.dmp

Filesize
408KB

Download
memory/4060-4-0x00007FFC0C640000-0x00007FFC0D101000-memory.dmp

Filesize
10.8MB

Download
memory/4060-8-0x00007FFC0C640000-0x00007FFC0D101000-memory.dmp

Filesize
10.8MB

Download
memory/4060-0-0x00007FFC0C643000-0x00007FFC0C645000-memory.dmp

Filesize
8KB

Download
memory/4060-3-0x0000027436BA0000-0x0000027436C32000-memory.dmp

Filesize
584KB

Download
memory/4060-2-0x0000027450DD0000-0x0000027450DE0000-memory.dmp

Filesize
64KB

Download
memory/4060-1-0x00000274367A0000-0x00000274367B0000-memory.dmp

Filesize
64KB

Download