agenttesla | 225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb

Resubmissions

16-01-2025 05:51

250116-gkbdnavpcv 10

16-01-2025 05:30

250116-f7kp6swjaj 10

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe
Size

302KB
MD5

b2be10d6564374a7c4bb58ef2a3567ee
SHA1

8c2819a0fb398d9eec0b18e20196fa1cb542633d
SHA256

225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb
SHA512

841112f9ef79513ce873100690f93136de8f100b98e946a898f003c76b49869d60a84bcac59f72c0e4e85ede554512ebdae0437e81e75361103027040115afcb
SSDEEP

6144:HJYai90JBVaVxUZG9W4CDTBedD/fCuw5TlklWtU7bR:HqafBjb0ZwBkl9

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.flexodesign.pt
Port:
587
Username:
[email protected]
Password:
Flexodesign2019

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/2164-1-0x0000000001130000-0x0000000001182000-memory.dmp	family_agenttesla

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2784	2164	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2784	2164	225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe	31
PID 2164 wrote to memory of 2784	2164	225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe	31
PID 2164 wrote to memory of 2784	2164	225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe	31
PID 2164 wrote to memory of 2784	2164	225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe	31

C:\Users\Admin\AppData\Local\Temp\225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe
C:\Users\Admin\AppData\Local\Temp\225988da4a11ea3a8b331707b7dd012d89e0cd7a3b8af41ce909d6bb550fddeb.exe sh $MOZILLA/ %SIGINT% "SIGTERM|DESTROY|SIGKILL"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 524
  2⤵
  - Program crash
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-0-0x000000007449E000-0x000000007449F000-memory.dmp

Filesize
4KB

Download
memory/2164-1-0x0000000001130000-0x0000000001182000-memory.dmp

Filesize
328KB

Download