agenttesla | 5950b78c46dedad1cfc35eca7819352e2447750e83b78834037a2c9f0be9d107

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15/11/2024, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Commercial Proposal.exe
Size

1.1MB
MD5

2b7bcb241184020513d46b1414a37bad
SHA1

c07eab1295718ce27a7f71f131b3bcc6e7d6615a
SHA256

97477b55cb7b77b482025a1166842438689a8c6854896552031c8c9bc9fa7f70
SHA512

75fde35d3bac578e384d395e77e9a76eb3cc2c928f82aae605bb12e310bf1f3e5882c2f8907abf32836df212298f269b97feafd71d02946350b94aefdb4b5b3c
SSDEEP

24576:Htb20pkaCqT5TBWgNQ7a2XvzK/7WBzFcOS6A:EVg5tQ7a2XLKUY5

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 2712	2556	Commercial Proposal.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Commercial Proposal.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2712	RegSvcs.exe
2712	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2556	Commercial Proposal.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30
PID 2556 wrote to memory of 2712	2556	Commercial Proposal.exe	30

C:\Users\Admin\AppData\Local\Temp\Commercial Proposal.exe
"C:\Users\Admin\AppData\Local\Temp\Commercial Proposal.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\Commercial Proposal.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\unrosined

Filesize
263KB

MD5
75e36a537617bbf6823ab5aeafe483fe

SHA1
33aca30482dbefc7b1732a29c81be751304cd791

SHA256
e78355ad9b37c572e8a4c700cdb837b5f5bafb743afa036ca8f2a063a04a2d1b

SHA512
2637250f09b045b92997d05b48ae8b63966cfb05b8eaae8a105f4af72233cf83d42951998e898c7d57624d787bfe5d3a0ded55ddfc14aa8ca3ae1245e1024a5a

Download Submit
memory/2556-7-0x0000000000AF0000-0x0000000000EF0000-memory.dmp

Filesize
4.0MB

Download
memory/2712-10-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2712-11-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2712-9-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2712-12-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

Filesize
4KB

Download
memory/2712-13-0x0000000000380000-0x00000000003D6000-memory.dmp

Filesize
344KB

Download
memory/2712-14-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-15-0x0000000000530000-0x0000000000584000-memory.dmp

Filesize
336KB

Download
memory/2712-16-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-17-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-29-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-41-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-77-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-75-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-73-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-69-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-67-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-65-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-63-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-61-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-59-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-57-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-55-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-53-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-51-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-47-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-45-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-43-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-39-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-37-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-35-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-33-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-31-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-71-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-49-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-27-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-25-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-23-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-21-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-19-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-18-0x0000000000530000-0x000000000057E000-memory.dmp

Filesize
312KB

Download
memory/2712-1086-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-1087-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2712-1088-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

Filesize
4KB

Download
memory/2712-1089-0x0000000073DB0000-0x000000007449E000-memory.dmp

Filesize
6.9MB

Download