agenttesla | 3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e

Analysis

max time kernel
103s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2025, 02:53 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe
Size

1.2MB
MD5

590e0ddfe21156fd0106e3d1fa313bc3
SHA1

8753129596e5a8c52ba93104656c4580aef49902
SHA256

3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e
SHA512

f62b8c0d9c0972353ef3c22290ed9724d9516604aa4e50b7a4762304e23384de01381d033afddae875ca7d2f7411c359b572504ca835ba2580fbbe58160b078d
SSDEEP

24576:WfmMv6Ckr7Mny5Q63xhh7HtqB93t6cdfJar7kiL:W3v+7/5Q63bhxqt6Jf

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.ercolina-usa.com
Port:
21
Username:
me@ercolina-usa.com
Password:
uy,o#mZj8$lY

Extracted

Family

agenttesla

Credentials

Protocol: ftp
Host:
ftp://ftp.ercolina-usa.com
Port:
21
Username:
me@ercolina-usa.com
Password:
uy,o#mZj8$lY

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\newapp = "C:\\Users\\Admin\\AppData\\Roaming\\newapp\\newapp.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4808 set thread context of 5032	4808	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5032	RegSvcs.exe
5032	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4808	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe
4808	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	RegSvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	RegSvcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 5032	4808	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe	83
PID 4808 wrote to memory of 5032	4808	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe	83
PID 4808 wrote to memory of 5032	4808	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe	83
PID 4808 wrote to memory of 5032	4808	3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe	83

C:\Users\Admin\AppData\Local\Temp\3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe
"C:\Users\Admin\AppData\Local\Temp\3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\3611974d2020430b02d33e21aa9c792b3a11757b7ea872742cf0c5e7df69684e.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5032

Network

DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

75.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.159.190.20.in-addr.arpa

IN PTR

Response
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

api.ipify.org

RegSvcs.exe

Remote address:

8.8.8.8:53

Request

api.ipify.org

IN A

Response

api.ipify.org

IN A

104.26.12.205

api.ipify.org

IN A

172.67.74.152

api.ipify.org

IN A

104.26.13.205
GET

https://api.ipify.org/

RegSvcs.exe

Remote address:

104.26.12.205:443

Request

GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Host: api.ipify.org
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sat, 11 Jan 2025 02:54:02 GMT
Content-Type: text/plain
Content-Length: 14
Connection: keep-alive
Vary: Origin
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 90019eb01d0e88c1-LHR
server-timing: cfL4;desc="?proto=TCP&rtt=30384&min_rtt=26457&rtt_var=12923&sent=6&recv=6&lost=0&retrans=0&sent_bytes=2980&recv_bytes=452&delivery_rate=137070&cwnd=253&unsent_bytes=0&cid=cf517993b0f6aa04&ts=164&x=0"
DNS

205.12.26.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

205.12.26.104.in-addr.arpa

IN PTR

Response
DNS

ftp.ercolina-usa.com

RegSvcs.exe

Remote address:

8.8.8.8:53

Request

ftp.ercolina-usa.com

IN A

Response

ftp.ercolina-usa.com

IN CNAME

ercolina-usa.com

ercolina-usa.com

IN A

192.254.225.136
DNS

136.225.254.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.225.254.192.in-addr.arpa

IN PTR

Response

136.225.254.192.in-addr.arpa

IN PTR

192-254-225-136unifiedlayercom
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

200.163.202.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.163.202.172.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

134.130.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

134.130.81.91.in-addr.arpa

IN PTR

Response
DNS

181.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

181.129.81.91.in-addr.arpa

IN PTR

Response
DNS

180.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.129.81.91.in-addr.arpa

IN PTR

Response
DNS

14.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.227.111.52.in-addr.arpa

IN PTR

Response

104.26.12.205:443

https://api.ipify.org/

tls, http

RegSvcs.exe

854 B
3.8kB
9
9

HTTP Request

GET https://api.ipify.org/

HTTP Response

200
192.254.225.136:21

ftp.ercolina-usa.com

ftp

RegSvcs.exe

361 B
700 B
7
8
192.254.225.136:21

ftp.ercolina-usa.com

ftp

RegSvcs.exe

361 B
700 B
7
8
192.254.225.136:21

ftp.ercolina-usa.com

ftp

RegSvcs.exe

361 B
700 B
7
8

8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

75.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

75.159.190.20.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

api.ipify.org

dns

RegSvcs.exe

59 B
107 B
1
1

DNS Request

api.ipify.org

DNS Response

104.26.12.205

172.67.74.152

104.26.13.205
8.8.8.8:53

205.12.26.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

205.12.26.104.in-addr.arpa
8.8.8.8:53

ftp.ercolina-usa.com

dns

RegSvcs.exe

66 B
96 B
1
1

DNS Request

ftp.ercolina-usa.com

DNS Response

192.254.225.136
8.8.8.8:53

136.225.254.192.in-addr.arpa

dns

74 B
120 B
1
1

DNS Request

136.225.254.192.in-addr.arpa
8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

200.163.202.172.in-addr.arpa

dns

74 B
160 B
1
1

DNS Request

200.163.202.172.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

134.130.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

134.130.81.91.in-addr.arpa
8.8.8.8:53

181.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

181.129.81.91.in-addr.arpa
8.8.8.8:53

180.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

180.129.81.91.in-addr.arpa
8.8.8.8:53

14.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-2-0x0000000004220000-0x0000000004420000-memory.dmp

Filesize
2.0MB

Download
memory/5032-3-0x0000000000570000-0x00000000005B4000-memory.dmp

Filesize
272KB

Download
memory/5032-4-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

Filesize
4KB

Download
memory/5032-5-0x0000000005110000-0x00000000056B4000-memory.dmp

Filesize
5.6MB

Download
memory/5032-6-0x0000000004CF0000-0x0000000004D56000-memory.dmp

Filesize
408KB

Download
memory/5032-7-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/5032-10-0x0000000006280000-0x00000000062D0000-memory.dmp

Filesize
320KB

Download
memory/5032-11-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

Filesize
4KB

Download
memory/5032-12-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/5032-13-0x00000000063F0000-0x0000000006482000-memory.dmp

Filesize
584KB

Download
memory/5032-14-0x0000000006390000-0x000000000639A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.