agenttesla | 2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe
Size

950KB
MD5

bd28f9a835c67ce45b3a3ca02f6737a2
SHA1

16dc478690c24f29b52186f0ed8c152007fdbaeb
SHA256

2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d
SHA512

c811d48001aade05a917e89770277a0af0a5f10639c1dd63c66d99728650c877d74f843ab4c9f57847f1654fe7240606072c51383a90811ec6aeb62ee91e2290
SSDEEP

12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCBWGvAbhGCPvkK3X1rGs2:uRmJkcoQricOIQxiZY1iaCBtvgvLdG9J

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2648	RegSvcs.exe
2648	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe
2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1760	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	30
PID 2324 wrote to memory of 1760	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	30
PID 2324 wrote to memory of 1760	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	30
PID 2324 wrote to memory of 1760	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	30
PID 2324 wrote to memory of 1760	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	30
PID 2324 wrote to memory of 1760	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	30
PID 2324 wrote to memory of 1760	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	30
PID 2324 wrote to memory of 2076	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	31
PID 2324 wrote to memory of 2076	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	31
PID 2324 wrote to memory of 2076	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	31
PID 2324 wrote to memory of 2076	2324	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	31
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32
PID 2076 wrote to memory of 2648	2076	2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe	32

C:\Users\Admin\AppData\Local\Temp\2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe
"C:\Users\Admin\AppData\Local\Temp\2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe
  "C:\Users\Admin\AppData\Local\Temp\2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\2f089d43e47839f07590fc97fbd2bbe91f08ff02d50b3a6b7fe68f3e1a81026d.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\niellists

Filesize
263KB

MD5
2d4142656f20e40ebcbb93ce8e567a0d

SHA1
13f8557b225fa9d6ebb32ee4df65e13ed11c602a

SHA256
1e73812a841938226b643b351f2681fa7c97a1cfe7e24d2a5e54aa43bb822ec6

SHA512
331d89c906c088216494162e896a79c80b7983861970a5c803dfcffb13e3826014b4c84b08333cfa4ac64e7a031632e7d3950acae800498acdff5d1097375acb

Download Submit
memory/2324-6-0x0000000000390000-0x0000000000394000-memory.dmp

Filesize
16KB

Download
memory/2648-14-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2648-16-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2648-17-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2648-18-0x000000007479E000-0x000000007479F000-memory.dmp

Filesize
4KB

Download
memory/2648-19-0x00000000001E0000-0x0000000000236000-memory.dmp

Filesize
344KB

Download
memory/2648-20-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-21-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-22-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2648-26-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-24-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-28-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-30-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-34-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-36-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-32-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-38-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-40-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-42-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-23-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-60-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-72-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-44-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-48-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-50-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-54-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-56-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-64-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-76-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-82-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-80-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-78-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-74-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-70-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-68-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-66-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-62-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-58-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-52-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-46-0x0000000000350000-0x000000000039E000-memory.dmp

Filesize
312KB

Download
memory/2648-1091-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-1092-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2648-1093-0x000000007479E000-0x000000007479F000-memory.dmp

Filesize
4KB

Download
memory/2648-1094-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-1095-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download
memory/2648-1096-0x0000000074790000-0x0000000074E7E000-memory.dmp

Filesize
6.9MB

Download