agenttesla | 24d0058069dc570d1b9600034802fe93e90c7e1367e9001f7444f0dc9213ec11

Analysis

max time kernel
105s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe
Size

1.1MB
MD5

5c40710df63be4d2df4acea915477002
SHA1

e70bdd344eb35cdb3be895b0f5d0649f266c1537
SHA256

24d0058069dc570d1b9600034802fe93e90c7e1367e9001f7444f0dc9213ec11
SHA512

8feb8adb9b047dc4b37f5fb94e2539c57a7cd0a6025312fdd12abcf2f6f008523f5166d70414fbf3fdaec6b8647ff68d9192c9e4fb66a1ad1012ca4a8b7e8f50
SSDEEP

24576:5u6J33O0c+JY5UZ+XC0kGso6FaN5gf/dzVCK+aKi1ZWY:7u0c++OCvkGs9FaN5KxsKsY

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.haliza.com.my
Port:
21
Username:
[email protected]
Password:
JesusChrist007$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Executes dropped EXE 1 IoCs

pid	Process
5656	sgxIb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	api.ipify.org
27	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1148-8-0x0000000000FF0000-0x00000000013F0000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1148 set thread context of 2180	1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgxIb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2180	RegSvcs.exe
2180	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe
1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe
1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	RegSvcs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 2180	1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe	89
PID 1148 wrote to memory of 2180	1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe	89
PID 1148 wrote to memory of 2180	1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe	89
PID 1148 wrote to memory of 2180	1148	PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe	89
PID 5584 wrote to memory of 5656	5584	cmd.exe	96
PID 5584 wrote to memory of 5656	5584	cmd.exe	96
PID 5584 wrote to memory of 5656	5584	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION PRINT OUT COPY MT103.EXE.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:5584
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut4640.tmp

Filesize
264KB

MD5
97835d4ff0df84ce717dce9d5bcd7012

SHA1
edd37bfa6ebcabab27b72d10561c77911a73498f

SHA256
f9615215be5d7d12bd6bd2531d10d826f728a4f781a46221588f039ca92f7c15

SHA512
0c038c3172ddf55950af89a8e763bf7f83ff80668f1a2d9eefb4ebdd26dcb24401a1068b9daa52287933af592c5e717cc331dce27f6cfbf16eed0d5700ffd0a8

Download Submit
C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
memory/1148-8-0x0000000000FF0000-0x00000000013F0000-memory.dmp

Filesize
4.0MB

Download
memory/2180-40-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-78-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-12-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2180-13-0x000000007393E000-0x000000007393F000-memory.dmp

Filesize
4KB

Download
memory/2180-14-0x0000000003000000-0x0000000003056000-memory.dmp

Filesize
344KB

Download
memory/2180-15-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/2180-16-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/2180-17-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/2180-18-0x00000000055C0000-0x0000000005614000-memory.dmp

Filesize
336KB

Download
memory/2180-19-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-34-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-76-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-74-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-72-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-70-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-68-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-66-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-64-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-60-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-58-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-56-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-54-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-52-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-50-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-48-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-46-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-44-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-11-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2180-10-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2180-32-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-38-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-30-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-28-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-26-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-24-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-22-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-20-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-36-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-62-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-42-0x00000000055C0000-0x000000000560F000-memory.dmp

Filesize
316KB

Download
memory/2180-1117-0x0000000005820000-0x0000000005886000-memory.dmp

Filesize
408KB

Download
memory/2180-1118-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/2180-9-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2180-1136-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/2180-1135-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/2180-1134-0x0000000006D40000-0x0000000006D4A000-memory.dmp

Filesize
40KB

Download
memory/2180-1133-0x0000000006D70000-0x0000000006E02000-memory.dmp

Filesize
584KB

Download
memory/2180-1128-0x0000000006C40000-0x0000000006C90000-memory.dmp

Filesize
320KB

Download
memory/2180-1129-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2180-1130-0x000000007393E000-0x000000007393F000-memory.dmp

Filesize
4KB

Download
memory/2180-1131-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/2180-1132-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/5656-1127-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download
memory/5656-1124-0x0000000005520000-0x000000000555C000-memory.dmp

Filesize
240KB

Download
memory/5656-1125-0x0000000001880000-0x00000000018A1000-memory.dmp

Filesize
132KB

Download
memory/5656-1123-0x0000000000D00000-0x0000000000D0E000-memory.dmp

Filesize
56KB

Download
memory/5656-1137-0x0000000073930000-0x00000000740E0000-memory.dmp

Filesize
7.7MB

Download