agenttesla | 3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602

Analysis

max time kernel
103s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13-07-2024 09:48

Target

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe
Size

1.0MB
MD5

99af50ba5059f85a1c8bd15ecf23fb3b
SHA1

276b986f4a09fc2dd4df54df5ca32817096f1318
SHA256

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602
SHA512

60a1df813458faf865c4ee73d66f58d4dca9de8a52c6b35119a14da59e6d5e640fe6752ec2a8599bf3b960b0b6bf083f533b56601d804df14d77dcc98aa47801
SSDEEP

12288:PaCIgcZcoaREnONS7zCm4ry3tr/QUC7z46a3c:ygec+OeuO9r4UiO3c

Score

10^/10

Family

agenttesla

Credentials

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 api.ipify.org
13 api.ipify.org

flow	ioc
12	api.ipify.org
13	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe

description	pid	process	target process
PID 1632 set thread context of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msbuild.exe

pid process

4236 msbuild.exe
4236 msbuild.exe

pid	process
4236	msbuild.exe
4236	msbuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exemsbuild.exe

description	pid	process
Token: SeDebugPrivilege	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe
Token: SeDebugPrivilege	4236	msbuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

msbuild.exe

pid process

4236 msbuild.exe

pid	process
4236	msbuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe

description	pid	process	target process
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 4236	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 3584	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 3584	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe
PID 1632 wrote to memory of 3584	1632	3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602.exe	msbuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
2⤵
PID:3584

memory/1632-8-0x00007FF9E3F60000-0x00007FF9E4A21000-memory.dmp

Filesize
10.8MB

Download
memory/1632-1-0x000001F5F4DB0000-0x000001F5F4DC0000-memory.dmp

Filesize
64KB

Download
memory/1632-2-0x000001F5F7230000-0x000001F5F7240000-memory.dmp

Filesize
64KB

Download
memory/1632-3-0x000001F5F7340000-0x000001F5F73D2000-memory.dmp

Filesize
584KB

Download
memory/1632-0-0x00007FF9E3F63000-0x00007FF9E3F65000-memory.dmp

Filesize
8KB

Download
memory/1632-4-0x00007FF9E3F60000-0x00007FF9E4A21000-memory.dmp

Filesize
10.8MB

Download
memory/4236-6-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

Filesize
4KB

Download
memory/4236-7-0x0000000006050000-0x00000000065F4000-memory.dmp

Filesize
5.6MB

Download
memory/4236-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4236-9-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/4236-10-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download
memory/4236-11-0x0000000006F10000-0x0000000006F60000-memory.dmp

Filesize
320KB

Download
memory/4236-12-0x0000000007000000-0x0000000007092000-memory.dmp

Filesize
584KB

Download
memory/4236-13-0x0000000007190000-0x000000000719A000-memory.dmp

Filesize
40KB

Download
memory/4236-14-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

Filesize
4KB

Download
memory/4236-15-0x0000000074F20000-0x00000000756D0000-memory.dmp

Filesize
7.7MB

Download