agenttesla | b134c04cd257ca36ed2805f81bb52e1b2020af8aacb357bd5bc5c0aacb8fdb51

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
15/11/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Offer Požega.exe
Size

1.1MB
MD5

2b7bcb241184020513d46b1414a37bad
SHA1

c07eab1295718ce27a7f71f131b3bcc6e7d6615a
SHA256

97477b55cb7b77b482025a1166842438689a8c6854896552031c8c9bc9fa7f70
SHA512

75fde35d3bac578e384d395e77e9a76eb3cc2c928f82aae605bb12e310bf1f3e5882c2f8907abf32836df212298f269b97feafd71d02946350b94aefdb4b5b3c
SSDEEP

24576:Htb20pkaCqT5TBWgNQ7a2XvzK/7WBzFcOS6A:EVg5tQ7a2XLKUY5

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2436 set thread context of 1488	2436	Offer Požega.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offer Požega.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1488	RegSvcs.exe
1488	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2436	Offer Požega.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1488	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31
PID 2436 wrote to memory of 1488	2436	Offer Požega.exe	31

C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe
"C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\unrosined

Filesize
263KB

MD5
75e36a537617bbf6823ab5aeafe483fe

SHA1
33aca30482dbefc7b1732a29c81be751304cd791

SHA256
e78355ad9b37c572e8a4c700cdb837b5f5bafb743afa036ca8f2a063a04a2d1b

SHA512
2637250f09b045b92997d05b48ae8b63966cfb05b8eaae8a105f4af72233cf83d42951998e898c7d57624d787bfe5d3a0ded55ddfc14aa8ca3ae1245e1024a5a

Download Submit
memory/1488-52-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-8-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1488-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1488-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1488-12-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/1488-13-0x0000000000890000-0x00000000008E6000-memory.dmp

Filesize
344KB

Download
memory/1488-14-0x0000000000C60000-0x0000000000CB4000-memory.dmp

Filesize
336KB

Download
memory/1488-15-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/1488-16-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/1488-18-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-24-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-76-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-74-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-70-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-68-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-66-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-64-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-62-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-60-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-58-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-50-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-54-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-1088-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/1488-48-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-46-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-44-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-42-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-38-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-36-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-34-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-33-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-30-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-28-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-26-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-22-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-20-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-72-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-56-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-40-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-17-0x0000000000C60000-0x0000000000CAE000-memory.dmp

Filesize
312KB

Download
memory/1488-1085-0x0000000074B20000-0x000000007520E000-memory.dmp

Filesize
6.9MB

Download
memory/1488-1086-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/1488-1087-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/2436-7-0x0000000000D60000-0x0000000001160000-memory.dmp

Filesize
4.0MB

Download