Overview
overview
10Static
static
10BastianHei...er.exe
windows7-x64
BastianHei...er.exe
windows10-2004-x64
BastianHei...23.exe
windows7-x64
3BastianHei...23.exe
windows10-2004-x64
10BastianHei...05.exe
windows7-x64
10BastianHei...05.exe
windows10-2004-x64
10BastianHei...05.exe
windows7-x64
10BastianHei...05.exe
windows10-2004-x64
10BastianHei...b5.exe
windows7-x64
3BastianHei...b5.exe
windows10-2004-x64
10BastianHei...88.exe
windows7-x64
10BastianHei...88.exe
windows10-2004-x64
10BastianHei...85.exe
windows7-x64
10BastianHei...85.exe
windows10-2004-x64
5BastianHei...7c.exe
windows7-x64
3BastianHei...7c.exe
windows10-2004-x64
3BastianHei...97.exe
windows7-x64
10BastianHei...97.exe
windows10-2004-x64
10BastianHei...89.exe
windows7-x64
3BastianHei...89.exe
windows10-2004-x64
3BastianHei...36.exe
windows7-x64
10BastianHei...36.exe
windows10-2004-x64
10BastianHei...61.exe
windows7-x64
3BastianHei...61.exe
windows10-2004-x64
3BastianHei...0b.exe
windows7-x64
10BastianHei...0b.exe
windows10-2004-x64
10BastianHei...49.exe
windows7-x64
BastianHei...49.exe
windows10-2004-x64
BastianHei...cd.exe
windows7-x64
10BastianHei...cd.exe
windows10-2004-x64
10BastianHei...c7.exe
windows7-x64
BastianHei...c7.exe
windows10-2004-x64
Analysis
-
max time kernel
29s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2025, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
BastianHein Malware samples/._Process killer.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BastianHein Malware samples/._Process killer.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
BastianHein Malware samples/AgentTesla/06664fb0f86485bcac0d663acb92e1966ec35ea9ecf4ae8c9456a7167cf06823.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
BastianHein Malware samples/AgentTesla/06664fb0f86485bcac0d663acb92e1966ec35ea9ecf4ae8c9456a7167cf06823.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
BastianHein Malware samples/AgentTesla/197b8f685fe939f045c8c17c01ab6811d2ad9f47ef63ddc3e667443966c0a005.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
BastianHein Malware samples/AgentTesla/197b8f685fe939f045c8c17c01ab6811d2ad9f47ef63ddc3e667443966c0a005.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
BastianHein Malware samples/AgentTesla/197b8f685fe939f045c8c17c01ab6811d2ad9f47ef63ddc3e667443966c0a005.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
BastianHein Malware samples/AgentTesla/197b8f685fe939f045c8c17c01ab6811d2ad9f47ef63ddc3e667443966c0a005.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
BastianHein Malware samples/AgentTesla/1f4c54d2e88831db0ece02e0ddd45d37743ccc634f729164048344ccabb378b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
BastianHein Malware samples/AgentTesla/1f4c54d2e88831db0ece02e0ddd45d37743ccc634f729164048344ccabb378b5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
BastianHein Malware samples/AgentTesla/2f83aacc31a29bb50a963b6f49cfe75d0f6f105f9d699571e312c3fd996b1888.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
BastianHein Malware samples/AgentTesla/2f83aacc31a29bb50a963b6f49cfe75d0f6f105f9d699571e312c3fd996b1888.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
BastianHein Malware samples/AgentTesla/309c72a0cfc3bd2a848c978921abe215da76dd3aa38f3221d28cb6524c35ba85.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
BastianHein Malware samples/AgentTesla/309c72a0cfc3bd2a848c978921abe215da76dd3aa38f3221d28cb6524c35ba85.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral15
Sample
BastianHein Malware samples/AgentTesla/31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
BastianHein Malware samples/AgentTesla/31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
BastianHein Malware samples/AgentTesla/56a8937692fdf9a9c0b6cc236a9d3297.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
BastianHein Malware samples/AgentTesla/56a8937692fdf9a9c0b6cc236a9d3297.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
BastianHein Malware samples/AgentTesla/708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
BastianHein Malware samples/AgentTesla/708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
BastianHein Malware samples/AgentTesla/9da74e41306059077f155debea5f44a5969e79297c9de44a4e355e4bb68b0536.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
BastianHein Malware samples/AgentTesla/9da74e41306059077f155debea5f44a5969e79297c9de44a4e355e4bb68b0536.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-145f6076604900c379d5a82d6a95e6c56df274b34d77158056dccb5834516461.exe
Resource
win7-20250207-en
Behavioral task
behavioral24
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-145f6076604900c379d5a82d6a95e6c56df274b34d77158056dccb5834516461.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-150f720cd5e58ff58c421398257b42b92318cec613c657825bc585a43db8270b.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-150f720cd5e58ff58c421398257b42b92318cec613c657825bc585a43db8270b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-15ec53cab469f3ee56ebb4bb924e7fd211585d273d2ce77d9fd1dbf7335e6249.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-15ec53cab469f3ee56ebb4bb924e7fd211585d273d2ce77d9fd1dbf7335e6249.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-3b6632b43aa88d79aa9bdcf19f38f11fd3b0a86915cef4408e390a4d70f068cd.exe
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-3b6632b43aa88d79aa9bdcf19f38f11fd3b0a86915cef4408e390a4d70f068cd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-47d4d0c51ec4940172fe3b02f8244547640661b9ba9efda0b7aa8238582a01c7.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
BastianHein Malware samples/AgentTesla/AgentTesla-47d4d0c51ec4940172fe3b02f8244547640661b9ba9efda0b7aa8238582a01c7.exe
Resource
win10v2004-20250314-en
General
-
Target
BastianHein Malware samples/AgentTesla/31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe
-
Size
1.1MB
-
MD5
d5ee88c8a72921aa9dca20317ed1ef5e
-
SHA1
5d9a100342fe7383479829d2d24343ee735a1826
-
SHA256
31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c
-
SHA512
29b3c4a0a1bf10ff0aa55cc6a26fa96e8b373e18dbb8eab6c344c64ed06cea13de5c27d6cd9f15649d6b317e7f44c1add939561235910747beffbcdb86a5f6a6
-
SSDEEP
24576:aUMC8CuZtC8YIBKHfaKWBECn6g2s0O8BD48rWHFDW+1RUrC:aU8CJ6BKHfavBECn6gL0O8BD48rWHFDD
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BastianHein Malware samples\AgentTesla\31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe"C:\Users\Admin\AppData\Local\Temp\BastianHein Malware samples\AgentTesla\31c25e01cbaaeadccfa1321680bbfd51c17b876859be87fff22b2db8ee1e117c.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4488