agenttesla | a9728615030bd131152dc0898470f5ddfd792ae459f56974be09f103c616e6fd

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
30/08/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Electro-08282024.exe
Size

1.2MB
MD5

9d3827e8622b4221588f60a3273cb725
SHA1

1f1521c7c0d0f999d1afa921036082729fdb9261
SHA256

cec92fba69ba56563b3e84ed87291bfb50a85a6e44b6a9b5cd698c00c380e0f0
SHA512

661900d0386cee1af5806a6ad274f2f7dfe3d4624bf065814a509b84d1ed905c86449a64b879d3283dedb9b88d4189423e30f967e9f268c6e8094b35eb0cca51
SSDEEP

24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8aF7wVq+wnazZkzFdd:8TvC/MTQYxsWR7aFAVlkzj

Score

10^/10

agenttesla credential_access discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2532 set thread context of 2696	2532	Electro-08282024.exe	32

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Electro-08282024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Electro-08282024.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2696	RegSvcs.exe
2696	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2668	Electro-08282024.exe
2532	Electro-08282024.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	RegSvcs.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2668	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe
2532	Electro-08282024.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2888	2668	Electro-08282024.exe	30
PID 2668 wrote to memory of 2888	2668	Electro-08282024.exe	30
PID 2668 wrote to memory of 2888	2668	Electro-08282024.exe	30
PID 2668 wrote to memory of 2888	2668	Electro-08282024.exe	30
PID 2668 wrote to memory of 2888	2668	Electro-08282024.exe	30
PID 2668 wrote to memory of 2888	2668	Electro-08282024.exe	30
PID 2668 wrote to memory of 2888	2668	Electro-08282024.exe	30
PID 2668 wrote to memory of 2532	2668	Electro-08282024.exe	31
PID 2668 wrote to memory of 2532	2668	Electro-08282024.exe	31
PID 2668 wrote to memory of 2532	2668	Electro-08282024.exe	31
PID 2668 wrote to memory of 2532	2668	Electro-08282024.exe	31
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32
PID 2532 wrote to memory of 2696	2532	Electro-08282024.exe	32

C:\Users\Admin\AppData\Local\Temp\Electro-08282024.exe
"C:\Users\Admin\AppData\Local\Temp\Electro-08282024.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Electro-08282024.exe"
  2⤵
  PID:2888
- C:\Users\Admin\AppData\Local\Temp\Electro-08282024.exe
  "C:\Users\Admin\AppData\Local\Temp\Electro-08282024.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\Electro-08282024.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\putrefactible

Filesize
84KB

MD5
390fa94f62bdefd38cbfc486f9297c8b

SHA1
bc86898405e2ebb4c7cfb2e2dbb66344f2bec757

SHA256
e1ea38d168ac41d99c158461afcd39f178a2b9c5c7c39f91f972632f213698f6

SHA512
af369f9a518371d3c298d8d3ac7d2d77b613aba309c774db7dbe95ba661d1d1c26a352056f7061bb370cf98cce7ed601eeb7dd32a1a3f8141cb493d81ffc94fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\subpredication

Filesize
263KB

MD5
a73e8df4ac816764a3ae54cc60cf2679

SHA1
cdbf4c0fa50e5ab7902c212505f1cb918fbbe27d

SHA256
c36cb3eaf2718e0df3bf8e1fb41379d9d97beb994570b14423e504b318732621

SHA512
06d85ed1f1b1fab6100e324268b0747f4a80618a15048c968abed678a5db6688937792d40a5eee2c334e2c379d3ba9eb5702f89c208d0f0073747ce568fa1236

Download Submit
C:\Users\Admin\AppData\Local\Temp\subpredication

Filesize
263KB

MD5
6f2b74a79584c48717794db5d55731d8

SHA1
148e3f5d3e6b2ea06ad1e86e2b8665d598afca97

SHA256
e5d50f8ba992e685b13a4e789f987395f39badfd5b6a849632f325af81f879cd

SHA512
42a691ef58db61d2c5f24b8f2fc4becda3b73e902d2ceb3861140021924c32415017c5892d6adf6bfd79a850a9b1865fca00675203d7992763e51e493b584f07

Download Submit
memory/2668-12-0x00000000001F0000-0x00000000001F4000-memory.dmp

Filesize
16KB

Download
memory/2696-76-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-29-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2696-30-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2696-31-0x000000007414E000-0x000000007414F000-memory.dmp

Filesize
4KB

Download
memory/2696-32-0x0000000000290000-0x00000000002E6000-memory.dmp

Filesize
344KB

Download
memory/2696-33-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-34-0x0000000001E10000-0x0000000001E64000-memory.dmp

Filesize
336KB

Download
memory/2696-35-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-36-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-38-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-50-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-82-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-96-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-94-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-92-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-90-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-88-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-86-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-84-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-80-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-72-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-27-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2696-74-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-70-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-68-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-66-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-64-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-62-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-60-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-56-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-54-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-52-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-48-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-46-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-44-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-42-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-40-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-78-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-58-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-37-0x0000000001E10000-0x0000000001E5E000-memory.dmp

Filesize
312KB

Download
memory/2696-1105-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-1106-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2696-1107-0x000000007414E000-0x000000007414F000-memory.dmp

Filesize
4KB

Download
memory/2696-1108-0x0000000074140000-0x000000007482E000-memory.dmp

Filesize
6.9MB

Download