Analysis

  • max time kernel
    29s
  • max time network
    43s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2025, 19:46

General

  • Target

    BastianHein Malware samples/AgentTesla/31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe

  • Size

    1.1MB

  • MD5

    d5ee88c8a72921aa9dca20317ed1ef5e

  • SHA1

    5d9a100342fe7383479829d2d24343ee735a1826

  • SHA256

    31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c

  • SHA512

    29b3c4a0a1bf10ff0aa55cc6a26fa96e8b373e18dbb8eab6c344c64ed06cea13de5c27d6cd9f15649d6b317e7f44c1add939561235910747beffbcdb86a5f6a6

  • SSDEEP

    24576:aUMC8CuZtC8YIBKHfaKWBECn6g2s0O8BD48rWHFDW+1RUrC:aU8CJ6BKHfavBECn6gL0O8BD48rWHFDD

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\BastianHein Malware samples\AgentTesla\31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe
    "C:\Users\Admin\AppData\Local\Temp\BastianHein Malware samples\AgentTesla\31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4488-0-0x00000000751CE000-0x00000000751CF000-memory.dmp

    Filesize

    4KB

  • memory/4488-1-0x0000000000AC0000-0x0000000000BDE000-memory.dmp

    Filesize

    1.1MB

  • memory/4488-2-0x0000000005CA0000-0x0000000006244000-memory.dmp

    Filesize

    5.6MB

  • memory/4488-3-0x0000000005620000-0x00000000056B2000-memory.dmp

    Filesize

    584KB

  • memory/4488-4-0x00000000751C0000-0x0000000075970000-memory.dmp

    Filesize

    7.7MB

  • memory/4488-5-0x00000000055C0000-0x00000000055CA000-memory.dmp

    Filesize

    40KB

  • memory/4488-6-0x00000000059F0000-0x0000000005A0E000-memory.dmp

    Filesize

    120KB

  • memory/4488-7-0x00000000751CE000-0x00000000751CF000-memory.dmp

    Filesize

    4KB

  • memory/4488-8-0x00000000751C0000-0x0000000075970000-memory.dmp

    Filesize

    7.7MB

  • memory/4488-9-0x00000000050A0000-0x0000000005126000-memory.dmp

    Filesize

    536KB

  • memory/4488-10-0x000000000DA80000-0x000000000DB1C000-memory.dmp

    Filesize

    624KB