agenttesla | 3928ecb91adb2eb4aa8dda8e08e862efbadd414aff85a4809850233abd0a7c2e

Analysis

max time kernel
22s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2025, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe
Size

1.6MB
MD5

91521adf3bb37d62cc859b84a3c85fb1
SHA1

fc3788e6ceaf1c5bbeebbb2c59b55883896ca25c
SHA256

24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694
SHA512

d78640b83a4504df2b40f471f8f6ab7bf3342a4478c0bae9b7bcb18194aa08b09683aac940cd860c458d4f1de544ae0d3f45f1e9d1ec8bd1d168ccdc7712e2e9
SSDEEP

24576:Au6J33O0c+JY5UZ+XC0kGso6FaOfvovS6StpmUO81BPr5hG7XSTqgiTncWR1WY:qu0c++OCvkGs9FaOAShtxOw7GbwxLY

Score

10^/10

agenttesla redline success discovery infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.xma0.com
Port:
587
Username:
[email protected]
Password:
london@1759

Extracted

Family

redline

Botnet

success

204.10.161.147:7082

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.xma0.com
Port:
587
Username:
[email protected]
Password:
london@1759
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000242eb-79.dat	family_redline
behavioral1/memory/1064-89-0x00000000005C0000-0x0000000000612000-memory.dmp	family_redline

Redline family
redline

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hypopygidium.vbs	hypopygidium.exe

Executes dropped EXE 4 IoCs

pid	Process
5748	hypopygidium.exe
4052	hypopygidium.exe
4040	Origin_rawfile.exe
1064	build.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000b000000024137-12.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 4652	4052	hypopygidium.exe	91

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hypopygidium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hypopygidium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Origin_rawfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4040	Origin_rawfile.exe
4040	Origin_rawfile.exe
1064	build.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5748	hypopygidium.exe
4052	hypopygidium.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	svchost.exe
Token: SeDebugPrivilege	4040	Origin_rawfile.exe
Token: SeDebugPrivilege	1064	build.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
312	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe
312	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe
5748	hypopygidium.exe
5748	hypopygidium.exe
4052	hypopygidium.exe
4052	hypopygidium.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
312	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe
312	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe
5748	hypopygidium.exe
5748	hypopygidium.exe
4052	hypopygidium.exe
4052	hypopygidium.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4040	Origin_rawfile.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 5748	312	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe	88
PID 312 wrote to memory of 5748	312	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe	88
PID 312 wrote to memory of 5748	312	24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe	88
PID 5748 wrote to memory of 5164	5748	hypopygidium.exe	89
PID 5748 wrote to memory of 5164	5748	hypopygidium.exe	89
PID 5748 wrote to memory of 5164	5748	hypopygidium.exe	89
PID 5748 wrote to memory of 4052	5748	hypopygidium.exe	90
PID 5748 wrote to memory of 4052	5748	hypopygidium.exe	90
PID 5748 wrote to memory of 4052	5748	hypopygidium.exe	90
PID 4052 wrote to memory of 4652	4052	hypopygidium.exe	91
PID 4052 wrote to memory of 4652	4052	hypopygidium.exe	91
PID 4052 wrote to memory of 4652	4052	hypopygidium.exe	91
PID 4052 wrote to memory of 4652	4052	hypopygidium.exe	91
PID 4652 wrote to memory of 4040	4652	svchost.exe	94
PID 4652 wrote to memory of 4040	4652	svchost.exe	94
PID 4652 wrote to memory of 4040	4652	svchost.exe	94
PID 4652 wrote to memory of 1064	4652	svchost.exe	95
PID 4652 wrote to memory of 1064	4652	svchost.exe	95
PID 4652 wrote to memory of 1064	4652	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe
"C:\Users\Admin\AppData\Local\Temp\24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:312
- C:\Users\Admin\AppData\Local\flexuosely\hypopygidium.exe
  "C:\Users\Admin\AppData\Local\Temp\24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5748
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694.exe"
    3⤵
    PID:5164
- - C:\Users\Admin\AppData\Local\flexuosely\hypopygidium.exe
    "C:\Users\Admin\AppData\Local\flexuosely\hypopygidium.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\flexuosely\hypopygidium.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Origin_rawfile.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Origin_rawfile.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\build.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Origin_rawfile.exe

Filesize
240KB

MD5
3edff8f7a6912d8e716903174487b77f

SHA1
5a5c01a933218192bea3da11b6f5d01601b7723c

SHA256
2386f8b71f47befd0dc493b373333a04735749dedc4a12240e47ea5930f85184

SHA512
83fd183717fa031a2d8a0f3e30de55f9645e66189cdb88cdb7e488e0180e82d6d7eb3699efcd646af71c9781a32e4dd74acb532a8c074d5046f658eded76fc18

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut7148.tmp

Filesize
721KB

MD5
b6e85171208d73a14937cd0ac9d0c7da

SHA1
de3f3418b610d1e4a0616307360931b831a2af08

SHA256
2fba27fc0314214a47b377014c4d23b1b5a947474b698ca3212a1ad349ffc8c3

SHA512
5987bed4200f9f58e17ec162425ed7364b984b1e6b7a6b33bb943de90aecd5ae1c042b68c240bea62ae5a0ece0270a4a3348f07f60e2dc3183dff6030162e864

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
300KB

MD5
209b15fade618af5831e6e2528a4fedc

SHA1
2efc49db01f3df2c1cd0a528c75e466a9478b698

SHA256
f07a706c0554ed9363bd396dd49f788a0df232caf0af01161d831a12b95d964d

SHA512
3431efa0cfe6c2262ed07a9fe084567d9548e586efcfa752e0cec455e07f8a3e6b3acacacef77317881a0682358cf92d37abad80730560c33cb1e2d564afa8be

Download Submit
C:\Users\Admin\AppData\Local\flexuosely\hypopygidium.exe

Filesize
1.6MB

MD5
91521adf3bb37d62cc859b84a3c85fb1

SHA1
fc3788e6ceaf1c5bbeebbb2c59b55883896ca25c

SHA256
24d9992ff5374362ef6cf3bc9bb327901547099700c43214adfc1d1e7a71a694

SHA512
d78640b83a4504df2b40f471f8f6ab7bf3342a4478c0bae9b7bcb18194aa08b09683aac940cd860c458d4f1de544ae0d3f45f1e9d1ec8bd1d168ccdc7712e2e9

Download Submit
memory/312-8-0x0000000001900000-0x0000000001D00000-memory.dmp

Filesize
4.0MB

Download
memory/1064-92-0x0000000004EE0000-0x0000000004EEA000-memory.dmp

Filesize
40KB

Download
memory/1064-96-0x00000000051D0000-0x000000000520C000-memory.dmp

Filesize
240KB

Download
memory/1064-90-0x0000000004F00000-0x0000000004F92000-memory.dmp

Filesize
584KB

Download
memory/1064-93-0x0000000005FE0000-0x00000000065F8000-memory.dmp

Filesize
6.1MB

Download
memory/1064-100-0x0000000006DC0000-0x0000000006F82000-memory.dmp

Filesize
1.8MB

Download
memory/1064-94-0x0000000005260000-0x000000000536A000-memory.dmp

Filesize
1.0MB

Download
memory/1064-97-0x0000000005210000-0x000000000525C000-memory.dmp

Filesize
304KB

Download
memory/1064-89-0x00000000005C0000-0x0000000000612000-memory.dmp

Filesize
328KB

Download
memory/1064-95-0x0000000005170000-0x0000000005182000-memory.dmp

Filesize
72KB

Download
memory/1064-101-0x0000000007B80000-0x00000000080AC000-memory.dmp

Filesize
5.2MB

Download
memory/4040-87-0x0000000000340000-0x0000000000382000-memory.dmp

Filesize
264KB

Download
memory/4040-91-0x0000000004D60000-0x0000000004DC6000-memory.dmp

Filesize
408KB

Download
memory/4040-98-0x0000000006390000-0x00000000063E0000-memory.dmp

Filesize
320KB

Download
memory/4040-99-0x0000000006480000-0x000000000651C000-memory.dmp

Filesize
624KB

Download
memory/4052-34-0x00000000019E0000-0x0000000001DE0000-memory.dmp

Filesize
4.0MB

Download
memory/4652-39-0x0000000005D50000-0x0000000005DF4000-memory.dmp

Filesize
656KB

Download
memory/4652-45-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-44-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-42-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-49-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-51-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-88-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4652-53-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-55-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-57-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-59-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-61-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-63-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-47-0x0000000005E60000-0x0000000005EFC000-memory.dmp

Filesize
624KB

Download
memory/4652-41-0x0000000005E60000-0x0000000005F02000-memory.dmp

Filesize
648KB

Download
memory/4652-40-0x00000000063B0000-0x0000000006954000-memory.dmp

Filesize
5.6MB

Download
memory/4652-36-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4652-38-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4652-37-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4652-35-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/5748-22-0x00000000014F0000-0x00000000018F0000-memory.dmp

Filesize
4.0MB

Download