agenttesla | e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe
Size

1.0MB
MD5

9b9757a5fbdba08d72cdbf792719ce05
SHA1

7c078ef89b481f54cd7662feee5667a05f1cf976
SHA256

e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470
SHA512

1c55ef18a10b757cf68662dceeb766891a260ba2d7befdce9bc243fe88f5367741773a34c940f623c8d0595237e7875e79a72df016767f058cc52a747dc021fb
SSDEEP

24576:pRmJkcoQricOIQxiZY1iapbS9lys5p3evn:mJZoQrbTFZY1iapopp32n

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2120	RegSvcs.exe
2120	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe
2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2120	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2060	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	31
PID 1708 wrote to memory of 2060	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	31
PID 1708 wrote to memory of 2060	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	31
PID 1708 wrote to memory of 2060	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	31
PID 1708 wrote to memory of 2060	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	31
PID 1708 wrote to memory of 2060	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	31
PID 1708 wrote to memory of 2060	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	31
PID 1708 wrote to memory of 2056	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	32
PID 1708 wrote to memory of 2056	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	32
PID 1708 wrote to memory of 2056	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	32
PID 1708 wrote to memory of 2056	1708	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	32
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33
PID 2056 wrote to memory of 2120	2056	e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe	33

C:\Users\Admin\AppData\Local\Temp\e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe
"C:\Users\Admin\AppData\Local\Temp\e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe"
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe
  "C:\Users\Admin\AppData\Local\Temp\e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\e3a98692873ba0cf199f4e0b22e80e3e648da2494824ac0094e64a806e5fe470.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\antholite

Filesize
263KB

MD5
18106b542d896dcfd28a57fe5456a160

SHA1
95032d525bd772bcb1277bb7a69c04f2dbd066fe

SHA256
7308837820a2e6b9fb32a9cc50dc20ba1deb5a2af307e50d11e92d45f6404539

SHA512
a5d3c348ee347687ee0487339563741b04d88192ac99abfb795824c49ba1b364893be931c9a5759b1717d58b782f826c1f618f0264d8d27e4e7e95dab2a55fb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\antholite

Filesize
263KB

MD5
97922ad76124355bf4a541fa9b7454d5

SHA1
c8c75993ca09c7a7f3123a4086a43d99bb8fb6a5

SHA256
7107f950f3851fb1baaac18abbe28ce1c794a504206d4cedd1c9964104d7bd98

SHA512
c37c410fcd61f1400e9d6e77812a780b4d2cc1bf025a68b922d87b9461f120b4cec9e1d1c4f523e05b6048f0c683fa17d50192f13e30a122aec8abced2da4fec

Download Submit
memory/1708-11-0x00000000003F0000-0x00000000003F4000-memory.dmp

Filesize
16KB

Download
memory/2120-69-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-1104-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download
memory/2120-28-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2120-65-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-30-0x00000000003A0000-0x00000000003F6000-memory.dmp

Filesize
344KB

Download
memory/2120-31-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download
memory/2120-32-0x0000000000590000-0x00000000005E4000-memory.dmp

Filesize
336KB

Download
memory/2120-33-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download
memory/2120-41-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-51-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-93-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-89-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-87-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-85-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-83-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-81-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-79-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-61-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-73-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-71-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-25-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2120-67-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-29-0x0000000073DFE000-0x0000000073DFF000-memory.dmp

Filesize
4KB

Download
memory/2120-27-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2120-77-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-57-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-55-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-53-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-49-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-47-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-45-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-43-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-39-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-37-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-91-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-75-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-59-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-35-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-34-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-1100-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download
memory/2120-1101-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2120-1102-0x0000000073DFE000-0x0000000073DFF000-memory.dmp

Filesize
4KB

Download
memory/2120-1103-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download
memory/2120-63-0x0000000000590000-0x00000000005DE000-memory.dmp

Filesize
312KB

Download
memory/2120-1105-0x0000000073DF0000-0x00000000744DE000-memory.dmp

Filesize
6.9MB

Download