agenttesla | 1a326608fcf76eabbcc227a1515eb23309a8e6adb6c18b2c23041e3ebf225c77

Analysis

max time kernel
105s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2025, 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OrderSpecificationsforMaterials.docx.exe
Size

1.1MB
MD5

ca5e9b87e7c8b8dc2b60edad5b0ef4d5
SHA1

be210e5855b7ac8337da25bea95117fdd66be619
SHA256

1a326608fcf76eabbcc227a1515eb23309a8e6adb6c18b2c23041e3ebf225c77
SHA512

4b460524f7d9834ba089de468783df9761342de4b06255fc3bb11a4907f6eb21f0529c8ad250989d3494437f4839dc355907fd023840eb842c21be9b35d6f1bd
SSDEEP

24576:eu6J33O0c+JY5UZ+XC0kGso6Fa1M+Tlxkm4ZugpWY:wu0c++OCvkGs9Fa1MQlxyupY

Score

10^/10

agenttesla discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.haliza.com.my
Port:
21
Username:
[email protected]
Password:
JesusChrist007$

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Executes dropped EXE 1 IoCs

pid	Process
1932	sgxIb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
25	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 1664	4972	OrderSpecificationsforMaterials.docx.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5880	4972	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgxIb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OrderSpecificationsforMaterials.docx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1664	RegSvcs.exe
1664	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4972	OrderSpecificationsforMaterials.docx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4972	OrderSpecificationsforMaterials.docx.exe
4972	OrderSpecificationsforMaterials.docx.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4972	OrderSpecificationsforMaterials.docx.exe
4972	OrderSpecificationsforMaterials.docx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1664	RegSvcs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 1664	4972	OrderSpecificationsforMaterials.docx.exe	88
PID 4972 wrote to memory of 1664	4972	OrderSpecificationsforMaterials.docx.exe	88
PID 4972 wrote to memory of 1664	4972	OrderSpecificationsforMaterials.docx.exe	88
PID 4972 wrote to memory of 1664	4972	OrderSpecificationsforMaterials.docx.exe	88
PID 1888 wrote to memory of 1932	1888	cmd.exe	98
PID 1888 wrote to memory of 1932	1888	cmd.exe	98
PID 1888 wrote to memory of 1932	1888	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\OrderSpecificationsforMaterials.docx.exe
"C:\Users\Admin\AppData\Local\Temp\OrderSpecificationsforMaterials.docx.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\OrderSpecificationsforMaterials.docx.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 732
  2⤵
  - Program crash
  PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:3492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut3C7C.tmp

Filesize
265KB

MD5
f119405d629fc7f3d4d1f2b7ed9eabe0

SHA1
535289bd26233af4a02952ec46f769269e4f0023

SHA256
d2b71b907cbdd9ef737c317b520e48cf1d7937440d7cbbf7740d3cf62a8af38d

SHA512
1c1dff100f9e2bd99f0c76e712d929a393981b21f028f34926dd4520b5ac44b5de403e7719cb2922cfe71e2b49e32c32e46e99902894177d6fe164ad8829eb8e

Download Submit
C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe

Filesize
44KB

MD5
9d352bc46709f0cb5ec974633a0c3c94

SHA1
1969771b2f022f9a86d77ac4d4d239becdf08d07

SHA256
2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390

SHA512
13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

Download Submit
memory/1664-38-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-62-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-11-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1664-12-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1664-13-0x000000007412E000-0x000000007412F000-memory.dmp

Filesize
4KB

Download
memory/1664-14-0x0000000005190000-0x00000000051E6000-memory.dmp

Filesize
344KB

Download
memory/1664-15-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1664-16-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1664-17-0x0000000005790000-0x0000000005D34000-memory.dmp

Filesize
5.6MB

Download
memory/1664-18-0x00000000051E0000-0x0000000005234000-memory.dmp

Filesize
336KB

Download
memory/1664-78-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-76-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-74-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-72-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-70-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-68-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-66-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-64-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-34-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-59-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-56-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-54-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-52-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-50-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-48-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-46-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-42-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-40-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-9-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1664-10-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1664-60-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-32-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-30-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-28-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-26-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-24-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-22-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-20-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-36-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-44-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-19-0x00000000051E0000-0x000000000522F000-memory.dmp

Filesize
316KB

Download
memory/1664-1118-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1664-1117-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/1664-1136-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1664-1135-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1664-1134-0x0000000006950000-0x000000000695A000-memory.dmp

Filesize
40KB

Download
memory/1664-1133-0x0000000006980000-0x0000000006A12000-memory.dmp

Filesize
584KB

Download
memory/1664-1132-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1664-1128-0x0000000006850000-0x00000000068A0000-memory.dmp

Filesize
320KB

Download
memory/1664-1129-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1664-1130-0x000000007412E000-0x000000007412F000-memory.dmp

Filesize
4KB

Download
memory/1664-1131-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1932-1127-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/1932-1125-0x00000000026A0000-0x00000000026C1000-memory.dmp

Filesize
132KB

Download
memory/1932-1124-0x0000000004BD0000-0x0000000004C0C000-memory.dmp

Filesize
240KB

Download
memory/1932-1123-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/1932-1137-0x0000000074120000-0x00000000748D0000-memory.dmp

Filesize
7.7MB

Download
memory/4972-8-0x0000000001100000-0x0000000001500000-memory.dmp

Filesize
4.0MB

Download