agenttesla | 60ca2d9fc5e1a088f6338456580085ccb67c660f9167ef48a8767adec10133df

Analysis

max time kernel
104s
max time network
108s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
14/08/2025, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REVISED PI.exe
Size 1.0MB
Sample250814-m8faeasmv8
SHA256 60ca2d9fc5e1a088f6338456580085ccb67c660f9167ef48a8767adec10133df
MD5 95aab44ac3c6329a826cc7adfe87a916
SHA1 6cf37c87b94776b3c6171f10c43cff9c705e8514
SHA512 6fba1cf334f0284425741a1aa4159264c6a9ee0479a8c0628537b1fad96d2f8fa76704e34a1df052bf39932eedfd8917816de2cd0d940e64a07c3d9eca037617
SSDEEP 24576:Ytb20pkaCqT5TBWgNQ7aX4o1AAmyrAY6A:hVg5tQ7aIoxmsR5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.yandex.com
Port
587
Username
[email protected]
Password
marcellinus360
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\polygamize.vbs	polygamize.exe

Executes dropped EXE 1 IoCs

pid	Process
5404	polygamize.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x001900000002b080-15.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5404 set thread context of 4764	5404	polygamize.exe	79

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REVISED PI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	polygamize.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4764	RegSvcs.exe
4764	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5404	polygamize.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	RegSvcs.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3000	REVISED PI.exe
3000	REVISED PI.exe
5404	polygamize.exe
5404	polygamize.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3000	REVISED PI.exe
3000	REVISED PI.exe
5404	polygamize.exe
5404	polygamize.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4764	RegSvcs.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 5404	3000	REVISED PI.exe	78
PID 3000 wrote to memory of 5404	3000	REVISED PI.exe	78
PID 3000 wrote to memory of 5404	3000	REVISED PI.exe	78
PID 5404 wrote to memory of 4764	5404	polygamize.exe	79
PID 5404 wrote to memory of 4764	5404	polygamize.exe	79
PID 5404 wrote to memory of 4764	5404	polygamize.exe	79
PID 5404 wrote to memory of 4764	5404	polygamize.exe	79

C:\Users\Admin\AppData\Local\Temp\REVISED PI.exe
"C:\Users\Admin\AppData\Local\Temp\REVISED PI.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\unfatigued\polygamize.exe
  "C:\Users\Admin\AppData\Local\Temp\REVISED PI.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\REVISED PI.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cunili

Path C:\Users\Admin\AppData\Local\Temp\cunili
Size 64KB
SHA256 6d94bff472d2a70265397e2a1f714c04c5014112a06c6b12fb350c1704547b24
MD5 d1ac16390736ab5f50b8efc7553013b8
SHA1 88375143e4dae149df497d55ce7af3edc09e0a4c
SHA512 d93d1ca71d931e022beb764a200aaf3371d23ce333753276a3e369dd9c2fe8ba8d7d94e5a3cbfb0a0538c465347daf014f22790755ee0d578ea34445551a4a4b
SSDEEP 1536:b7h1I0ePEyp547hk7bIMQ7YVsLZNkJ6347I/Z/q:b7P6h47hkAV7YiLwJ634A5q
MD5 SHA1 SHA512 SSDEEP

Submit Download

intersentimental

Path C:\Users\Admin\AppData\Local\Temp\intersentimental
Size 43KB
SHA256 6ba18d5a4378dacb0a8a05ccbaf59ae2a8997e1d0dea638dc1a27a157e620759
MD5 17e84c119a2c92653b32be11856fa7d4
SHA1 5166f65f7d57d1d0f3a3df34a189a4dae2df1710
SHA512 2f877c05fc0cd2ac859830a2c63ad81a336724d85c0da48720d96cb213dbe90b1881fed73f1aa18fd1686a4d60744449dd5a7cc7b899d73481b0a74d1bd32b73
SSDEEP 768:4Pv887MEvViXs62Izv3KeaeKlT3WloVTI:8MBqs
MD5 SHA1 SHA512 SSDEEP

Submit Download

polygamize.exe

Path C:\Users\Admin\AppData\Local\unfatigued\polygamize.exe
Size 1.0MB
SHA256 60ca2d9fc5e1a088f6338456580085ccb67c660f9167ef48a8767adec10133df
MD5 95aab44ac3c6329a826cc7adfe87a916
SHA1 6cf37c87b94776b3c6171f10c43cff9c705e8514
SHA512 6fba1cf334f0284425741a1aa4159264c6a9ee0479a8c0628537b1fad96d2f8fa76704e34a1df052bf39932eedfd8917816de2cd0d940e64a07c3d9eca037617
SSDEEP 24576:Ytb20pkaCqT5TBWgNQ7aX4o1AAmyrAY6A:hVg5tQ7aIoxmsR5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3000-12-0x0000000001740000-0x0000000001B40000-memory.dmp

Download

memory/4764-34-0x0000000005D00000-0x00000000062A6000-memory.dmp

Download

memory/4764-33-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/4764-35-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/4764-36-0x0000000005750000-0x00000000057B6000-memory.dmp

Download

memory/4764-37-0x0000000006B30000-0x0000000006B80000-memory.dmp

Download

memory/4764-38-0x0000000006C20000-0x0000000006CB2000-memory.dmp

Download

memory/4764-39-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

Download

memory/4764-40-0x0000000005740000-0x0000000005750000-memory.dmp

Download

memory/5404-31-0x0000000001390000-0x0000000001790000-memory.dmp

Download