Overview

overview

10

Static

static

5

de4bc15775...e4.exe

windows7-x64

10

de4bc15775...e4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 01:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    de4bc15775cd8399127b6e2024cef3f1a1feb343dd6d8a60916ec4c1e7b4cde4.exe

  • Size

    1.2MB

  • MD5

    8d1ed16b33faf36da6ff6d3dd4a300e6

  • SHA1

    96ba1dd19b0613f28a0879a20a0bb98f51c1716b

  • SHA256

    de4bc15775cd8399127b6e2024cef3f1a1feb343dd6d8a60916ec4c1e7b4cde4

  • SHA512

    855e8006c20337b2e9575f37dbe33ec1007fc7d8ec0ec23122c2bd476a75d5f9557cd5df1aa0c8fff75314189a8c947f757bf5fae4f94386331a3c8970e771f8

  • SSDEEP

    24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8ah6nnjqKoeB+8TvGWUO:bTvC/MTQYxsWR7akjqKoeBFU

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de4bc15775cd8399127b6e2024cef3f1a1feb343dd6d8a60916ec4c1e7b4cde4.exe
    "C:\Users\Admin\AppData\Local\Temp\de4bc15775cd8399127b6e2024cef3f1a1feb343dd6d8a60916ec4c1e7b4cde4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\de4bc15775cd8399127b6e2024cef3f1a1feb343dd6d8a60916ec4c1e7b4cde4.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:980

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/980-11-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

          Download

        • memory/980-12-0x000000007492E000-0x000000007492F000-memory.dmp

          Filesize

          4KB

          Download

        • memory/980-13-0x00000000058C0000-0x0000000005E64000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/980-14-0x0000000005410000-0x0000000005476000-memory.dmp

          Filesize

          408KB

          Download

        • memory/980-15-0x0000000074920000-0x00000000750D0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/980-16-0x00000000067D0000-0x0000000006820000-memory.dmp

          Filesize

          320KB

          Download

        • memory/980-17-0x00000000068C0000-0x0000000006952000-memory.dmp

          Filesize

          584KB

          Download

        • memory/980-18-0x00000000068A0000-0x00000000068AA000-memory.dmp

          Filesize

          40KB

          Download

        • memory/980-19-0x000000007492E000-0x000000007492F000-memory.dmp

          Filesize

          4KB

          Download

        • memory/980-20-0x0000000074920000-0x00000000750D0000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4732-10-0x00000000028C0000-0x00000000028C4000-memory.dmp

          Filesize

          16KB

          Download