agenttesla | 24d0058069dc570d1b9600034802fe93e90c7e1367e9001f7444f0dc9213ec11

Analysis

max time kernel
108s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
Size

1.1MB
MD5

5c40710df63be4d2df4acea915477002
SHA1

e70bdd344eb35cdb3be895b0f5d0649f266c1537
SHA256

24d0058069dc570d1b9600034802fe93e90c7e1367e9001f7444f0dc9213ec11
SHA512

8feb8adb9b047dc4b37f5fb94e2539c57a7cd0a6025312fdd12abcf2f6f008523f5166d70414fbf3fdaec6b8647ff68d9192c9e4fb66a1ad1012ca4a8b7e8f50
SSDEEP

24576:5u6J33O0c+JY5UZ+XC0kGso6FaN5gf/dzVCK+aKi1ZWY:7u0c++OCvkGs9FaN5KxsKsY

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.haliza.com.my
Port:
21
Username:
[email protected]
Password:
JesusChrist007$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Executes dropped EXE 1 IoCs

pid	Process
3768	sgxIb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
23	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4244 set thread context of 4584	4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgxIb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	RegSvcs.exe
4584	RegSvcs.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4584	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 3584	6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	88
PID 6016 wrote to memory of 3584	6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	88
PID 6016 wrote to memory of 3584	6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	88
PID 6016 wrote to memory of 4244	6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	89
PID 6016 wrote to memory of 4244	6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	89
PID 6016 wrote to memory of 4244	6016	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	89
PID 4244 wrote to memory of 4584	4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	90
PID 4244 wrote to memory of 4584	4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	90
PID 4244 wrote to memory of 4584	4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	90
PID 4244 wrote to memory of 4584	4244	PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe	90
PID 4924 wrote to memory of 3768	4924	cmd.exe	95
PID 4924 wrote to memory of 3768	4924	cmd.exe	95
PID 4924 wrote to memory of 3768	4924	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe"
  2⤵
  PID:3584
- C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe
  "C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\PAYMENTCONFIRMATIONPRINTOUTCOPYMT103.EXE.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autB362.tmp

Filesize
264KB

MD5
97835d4ff0df84ce717dce9d5bcd7012

SHA1
edd37bfa6ebcabab27b72d10561c77911a73498f

SHA256
f9615215be5d7d12bd6bd2531d10d826f728a4f781a46221588f039ca92f7c15

SHA512
0c038c3172ddf55950af89a8e763bf7f83ff80668f1a2d9eefb4ebdd26dcb24401a1068b9daa52287933af592c5e717cc331dce27f6cfbf16eed0d5700ffd0a8

Download Submit
C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
memory/3768-1134-0x00000000002C0000-0x00000000002CE000-memory.dmp

Filesize
56KB

Download
memory/3768-1136-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Filesize
132KB

Download
memory/3768-1135-0x0000000004AA0000-0x0000000004ADC000-memory.dmp

Filesize
240KB

Download
memory/4244-18-0x0000000000F60000-0x0000000001360000-memory.dmp

Filesize
4.0MB

Download
memory/4584-59-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-1142-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-20-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4584-19-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4584-23-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

Filesize
4KB

Download
memory/4584-24-0x0000000004FF0000-0x0000000005046000-memory.dmp

Filesize
344KB

Download
memory/4584-25-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-26-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-27-0x0000000005780000-0x0000000005D24000-memory.dmp

Filesize
5.6MB

Download
memory/4584-1129-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-29-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-57-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-67-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-65-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-89-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-87-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-86-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-83-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-81-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-79-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-75-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-71-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-63-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-62-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-22-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4584-55-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-21-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4584-1128-0x00000000052D0000-0x0000000005336000-memory.dmp

Filesize
408KB

Download
memory/4584-28-0x0000000005080000-0x00000000050D4000-memory.dmp

Filesize
336KB

Download
memory/4584-52-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-49-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-45-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-43-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-41-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-77-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-73-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-69-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-47-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-39-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-37-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-35-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-33-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-31-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-30-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-1138-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4584-1139-0x0000000006840000-0x0000000006890000-memory.dmp

Filesize
320KB

Download
memory/4584-1140-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

Filesize
4KB

Download
memory/4584-1141-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-53-0x0000000005080000-0x00000000050CF000-memory.dmp

Filesize
316KB

Download
memory/4584-1143-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-1144-0x0000000006970000-0x0000000006A02000-memory.dmp

Filesize
584KB

Download
memory/4584-1145-0x0000000006940000-0x000000000694A000-memory.dmp

Filesize
40KB

Download
memory/4584-1146-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/6016-8-0x0000000001510000-0x0000000001910000-memory.dmp

Filesize
4.0MB

Download