Analysis Overview
SHA256
b134c04cd257ca36ed2805f81bb52e1b2020af8aacb357bd5bc5c0aacb8fdb51
Threat Level: Known bad
The file b134c04cd257ca36ed2805f81bb52e1b2020af8aacb357bd5bc5c0aacb8fdb51 was found to be: Known bad.
Malicious Activity Summary
Agenttesla family
AgentTesla
Looks up external IP address via web service
AutoIT Executable
Suspicious use of SetThreadContext
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-15 01:57
Signatures
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-15 01:57
Reported
2024-11-15 02:00
Platform
win7-20240729-en
Max time kernel
119s
Max time network
120s
Command Line
Signatures
AgentTesla
Agenttesla family
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2436 set thread context of 1488 | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe
"C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\unrosined
| MD5 | 75e36a537617bbf6823ab5aeafe483fe |
| SHA1 | 33aca30482dbefc7b1732a29c81be751304cd791 |
| SHA256 | e78355ad9b37c572e8a4c700cdb837b5f5bafb743afa036ca8f2a063a04a2d1b |
| SHA512 | 2637250f09b045b92997d05b48ae8b63966cfb05b8eaae8a105f4af72233cf83d42951998e898c7d57624d787bfe5d3a0ded55ddfc14aa8ca3ae1245e1024a5a |
memory/2436-7-0x0000000000D60000-0x0000000001160000-memory.dmp
memory/1488-8-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1488-10-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1488-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1488-12-0x0000000074B2E000-0x0000000074B2F000-memory.dmp
memory/1488-13-0x0000000000890000-0x00000000008E6000-memory.dmp
memory/1488-14-0x0000000000C60000-0x0000000000CB4000-memory.dmp
memory/1488-15-0x0000000074B20000-0x000000007520E000-memory.dmp
memory/1488-16-0x0000000074B20000-0x000000007520E000-memory.dmp
memory/1488-18-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-24-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-76-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-74-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-70-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-68-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-66-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-64-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-62-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-60-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-58-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-54-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-52-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-50-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-48-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-46-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-44-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-42-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-38-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-36-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-34-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-33-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-30-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-28-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-26-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-22-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-20-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-72-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-56-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-40-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-17-0x0000000000C60000-0x0000000000CAE000-memory.dmp
memory/1488-1085-0x0000000074B20000-0x000000007520E000-memory.dmp
memory/1488-1086-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1488-1087-0x0000000074B2E000-0x0000000074B2F000-memory.dmp
memory/1488-1088-0x0000000074B20000-0x000000007520E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-15 01:57
Reported
2024-11-15 02:00
Platform
win10v2004-20241007-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
AgentTesla
Agenttesla family
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2280 set thread context of 4456 | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2280 wrote to memory of 4456 | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
| PID 2280 wrote to memory of 4456 | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
| PID 2280 wrote to memory of 4456 | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
| PID 2280 wrote to memory of 4456 | N/A | C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe
"C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\Offer Požega.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 182.129.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\aut6F73.tmp
| MD5 | 75e36a537617bbf6823ab5aeafe483fe |
| SHA1 | 33aca30482dbefc7b1732a29c81be751304cd791 |
| SHA256 | e78355ad9b37c572e8a4c700cdb837b5f5bafb743afa036ca8f2a063a04a2d1b |
| SHA512 | 2637250f09b045b92997d05b48ae8b63966cfb05b8eaae8a105f4af72233cf83d42951998e898c7d57624d787bfe5d3a0ded55ddfc14aa8ca3ae1245e1024a5a |
memory/2280-8-0x0000000001400000-0x0000000001800000-memory.dmp
memory/4456-9-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4456-12-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4456-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4456-10-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4456-13-0x000000007456E000-0x000000007456F000-memory.dmp
memory/4456-14-0x0000000005490000-0x00000000054E6000-memory.dmp
memory/4456-15-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4456-16-0x0000000005A90000-0x0000000006034000-memory.dmp
memory/4456-17-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4456-19-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4456-18-0x00000000054E0000-0x0000000005534000-memory.dmp
memory/4456-33-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-43-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-79-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-77-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-75-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-73-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-69-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-67-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-65-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-63-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-61-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-59-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-57-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-53-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-51-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-49-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-47-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-45-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-41-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-39-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-37-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-35-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-31-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-29-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-27-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-25-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-23-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-21-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-20-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-71-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-55-0x00000000054E0000-0x000000000552E000-memory.dmp
memory/4456-1088-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/4456-1089-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4456-1090-0x0000000006B40000-0x0000000006B90000-memory.dmp
memory/4456-1091-0x0000000006C30000-0x0000000006CC2000-memory.dmp
memory/4456-1092-0x0000000006BD0000-0x0000000006BDA000-memory.dmp
memory/4456-1093-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4456-1094-0x000000007456E000-0x000000007456F000-memory.dmp
memory/4456-1095-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/4456-1096-0x0000000074560000-0x0000000074D10000-memory.dmp