Analysis
- max time kernel
149s - max time network
134s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
01/12/2025, 07:36
General
- Target 8411052900.exe
- Size 1.2MB
- Sample251201-jfcr2avkat
- SHA256 4594fcc979ece644907fedfb37dbb08ea5f15f0681719c29560aab7efe310e59
Malware Config
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
false
-
startup_directory_name
GLOZVJ
-
startup_env_name
appdata
-
startup_installation_name
GLOZVJ.exe
-
startup_reg_name
GLOZVJ
-
tor_pid
false
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8411052900.exe"C:\Users\Admin\AppData\Local\Temp\8411052900.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Myriopoda\penstocks.exe"C:\Users\Admin\AppData\Local\Temp\8411052900.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\8411052900.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
penstocks.exe
aut7242.tmp
deblateration
memory/1648-11-0x00000000028C0000-0x00000000028C4000-memory.dmp
memory/3076-30-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3076-31-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3076-33-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3076-32-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3076-34-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3076-35-0x0000000003570000-0x00000000035C4000-memory.dmp
memory/3076-36-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3076-37-0x0000000006060000-0x0000000006606000-memory.dmp
memory/3076-38-0x0000000005AB0000-0x0000000005B02000-memory.dmp
memory/3076-48-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-74-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-154-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-158-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-156-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-152-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-150-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-148-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-144-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-142-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-140-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-138-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-136-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-134-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-132-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-130-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-126-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-124-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-122-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-120-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-118-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-116-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-114-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-112-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-108-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-106-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-104-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-102-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-100-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-98-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-96-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-94-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-90-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-88-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-86-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-85-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-82-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-81-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-78-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-76-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-72-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-70-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-68-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-66-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-65-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-62-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-60-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-58-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-56-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-54-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-52-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-50-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-46-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-44-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-42-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-146-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-128-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-110-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-92-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-40-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-39-0x0000000005AB0000-0x0000000005AFD000-memory.dmp
memory/3076-1069-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3076-1070-0x0000000005C70000-0x0000000005CD6000-memory.dmp
memory/3076-1071-0x0000000006A70000-0x0000000006AC0000-memory.dmp
memory/3076-1072-0x0000000006B60000-0x0000000006BF2000-memory.dmp
memory/3076-1073-0x0000000006A50000-0x0000000006A5A000-memory.dmp
memory/3076-1074-0x0000000000400000-0x0000000000446000-memory.dmp
memory/3076-1075-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3076-1076-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3076-1077-0x0000000003610000-0x0000000003620000-memory.dmp
memory/3076-1078-0x0000000003610000-0x0000000003620000-memory.dmp