agenttesla | 24d0058069dc570d1b9600034802fe93e90c7e1367e9001f7444f0dc9213ec11

Analysis

max time kernel
134s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
Size

1.1MB
MD5

5c40710df63be4d2df4acea915477002
SHA1

e70bdd344eb35cdb3be895b0f5d0649f266c1537
SHA256

24d0058069dc570d1b9600034802fe93e90c7e1367e9001f7444f0dc9213ec11
SHA512

8feb8adb9b047dc4b37f5fb94e2539c57a7cd0a6025312fdd12abcf2f6f008523f5166d70414fbf3fdaec6b8647ff68d9192c9e4fb66a1ad1012ca4a8b7e8f50
SSDEEP

24576:5u6J33O0c+JY5UZ+XC0kGso6FaN5gf/dzVCK+aKi1ZWY:7u0c++OCvkGs9FaN5KxsKsY

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.haliza.com.my
Port:
21
Username:
[email protected]
Password:
JesusChrist007$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2540	RegSvcs.exe
2540	RegSvcs.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6092	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	RegSvcs.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe
Token: SeShutdownPrivilege	6092	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe
6092	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2540	RegSvcs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30
PID 2168 wrote to memory of 2540	2168	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2540

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nonagglutinant

Filesize
264KB

MD5
97835d4ff0df84ce717dce9d5bcd7012

SHA1
edd37bfa6ebcabab27b72d10561c77911a73498f

SHA256
f9615215be5d7d12bd6bd2531d10d826f728a4f781a46221588f039ca92f7c15

SHA512
0c038c3172ddf55950af89a8e763bf7f83ff80668f1a2d9eefb4ebdd26dcb24401a1068b9daa52287933af592c5e717cc331dce27f6cfbf16eed0d5700ffd0a8

Download Submit
memory/2168-7-0x0000000000AF0000-0x0000000000EF0000-memory.dmp

Filesize
4.0MB

Download
memory/2540-8-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2540-10-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2540-11-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2540-12-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/2540-13-0x0000000000AB0000-0x0000000000B06000-memory.dmp

Filesize
344KB

Download
memory/2540-15-0x0000000004310000-0x0000000004364000-memory.dmp

Filesize
336KB

Download
memory/2540-14-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-17-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-16-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-25-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-77-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-75-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-73-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-71-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-69-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-67-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-65-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-63-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-61-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-59-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-57-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-55-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-53-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-51-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-47-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-45-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-43-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-41-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-39-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-37-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-35-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-33-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-31-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-27-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-23-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-49-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-21-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-19-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-29-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-18-0x0000000004310000-0x000000000435F000-memory.dmp

Filesize
316KB

Download
memory/2540-1116-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-1117-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2540-1119-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/2540-1120-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-1121-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-1122-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-1123-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download