agenttesla | 95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe
Size

35KB
MD5

97e22a9d4aa0d4cfab11ec3af470a070
SHA1

ef29a39d263de303cbf5daaaff90c557e4563b6e
SHA256

95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19
SHA512

8bc2b7e55f747e721e0d0c65d1f7b054af0a42ebb34d76ff1489820c46001e34a7889c77d8ab32255d9fd5a2181a5ba36920b7a9b91c5b893f805c299d1fc07f
SSDEEP

384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan upx

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe

Executes dropped EXE 1 IoCs

pid	Process
1932	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MyApp = "C:\\WINDOWS\\system.exe"	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023ca0-7.dat	upx
behavioral2/memory/4848-15-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1932-17-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system.exe	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4848	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe
1932	system.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 1932	4848	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe	83
PID 4848 wrote to memory of 1932	4848	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe	83
PID 4848 wrote to memory of 1932	4848	95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe	83

C:\Users\Admin\AppData\Local\Temp\95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe
"C:\Users\Admin\AppData\Local\Temp\95ca04b4abadcb3028812e9ded490aa0ba3b5c31e0ed2bff3a46ec5534c31e19N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848
- C:\WINDOWS\system.exe
  "C:\WINDOWS\system.exe" 0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system.exe

Filesize
35KB

MD5
31207c08830176d018c27874baa5346e

SHA1
6774038c8658b3db7a7ec1fe9b945560c274fceb

SHA256
cc5a1f1532e1b8f6d1a075d9b1c8b7a94e8b28f5af35918fb0bb324f6a3d7a05

SHA512
936610fb80dae11f7bb17d9656577a98899cdf05128e63fc6047108d19fbcbc913ca3efd3209c54b4b2691a5bd03462940ec3ee166243ad2ae82505b7d33d5f1

Download Submit
memory/1932-17-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4848-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4848-15-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads