agenttesla | eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe
Size

368KB
MD5

cfbfabd8e0b67d01a19458be6b945517
SHA1

fa3d597f04aa2dd1e7f97c9b8f9c69a5411c6361
SHA256

eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f
SHA512

1927b7b6f8cc1bbe2dd786986c806e7b44574f859968bf0fd4046daf8ad4a4e1ce02ca5d511c2b48e3c5b3e838eeb4b0e5bd2ad9a27313eaae6d6011a675bb9a
SSDEEP

384:ESKu2cP3nyEVPTHWKtL2H0VuM35zlQEew+yTzSf4JM54iICSCr4H444uiiiL1CjW:N3vnyAWkaHRQMwdz+4H4447iiL1o

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe

description	pid	Process	procid_target
PID 880 created 3436	880	eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe	56

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
35	api.ipify.org
36	api.ipify.org

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exeaspnet_compiler.exe

pid	Process
880	eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe
1392	aspnet_compiler.exe
1392	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exeaspnet_compiler.exe

description	pid	Process
Token: SeDebugPrivilege	880	eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe
Token: SeDebugPrivilege	880	eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe
Token: SeDebugPrivilege	1392	aspnet_compiler.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid	Process
1392	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe

description	pid	Process	procid_target
PID 880 wrote to memory of 1392	880	eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe	93
PID 880 wrote to memory of 1392	880	eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe	93
PID 880 wrote to memory of 1392	880	eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe
  "C:\Users\Admin\AppData\Local\Temp\eda66fd0e1f4c8f0cdda206c461373ec760cc02eb0972c121cdf0ffc64702f8f.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/880-0-0x00007FFA367A3000-0x00007FFA367A5000-memory.dmp

Filesize
8KB

Download
memory/880-1-0x000001DAFC770000-0x000001DAFC7D0000-memory.dmp

Filesize
384KB

Download
memory/880-2-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/880-3-0x000001DAFEF20000-0x000001DAFF03E000-memory.dmp

Filesize
1.1MB

Download
memory/880-11-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-15-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-57-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-67-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-65-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-63-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-61-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-59-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-55-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-53-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-51-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-49-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-45-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-41-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-39-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-37-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-35-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-33-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-31-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-29-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-25-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-23-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-21-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-17-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-13-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-9-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-47-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-43-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-7-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-27-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-19-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-5-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-4-0x000001DAFEF20000-0x000001DAFF037000-memory.dmp

Filesize
1.1MB

Download
memory/880-1078-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/880-1080-0x000001DAFEC60000-0x000001DAFECAC000-memory.dmp

Filesize
304KB

Download
memory/880-1079-0x000001DAFF040000-0x000001DAFF0D8000-memory.dmp

Filesize
608KB

Download
memory/880-1084-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/880-1085-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/880-1086-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/880-1087-0x00007FFA367A3000-0x00007FFA367A5000-memory.dmp

Filesize
8KB

Download
memory/880-1088-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/880-1090-0x000001DA992B0000-0x000001DA99304000-memory.dmp

Filesize
336KB

Download
memory/880-1093-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/1392-1092-0x00000262E2620000-0x00000262E2665000-memory.dmp

Filesize
276KB

Download
memory/1392-1094-0x00007FFA367A3000-0x00007FFA367A5000-memory.dmp

Filesize
8KB

Download
memory/1392-1095-0x00000262E41C0000-0x00000262E4202000-memory.dmp

Filesize
264KB

Download
memory/1392-1096-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/1392-1097-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download
memory/1392-1098-0x00000262FDE10000-0x00000262FDE60000-memory.dmp

Filesize
320KB

Download
memory/1392-1099-0x00007FFA367A3000-0x00007FFA367A5000-memory.dmp

Filesize
8KB

Download
memory/1392-1100-0x00007FFA367A0000-0x00007FFA37261000-memory.dmp

Filesize
10.8MB

Download