Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
08/12/2025, 16:12
General
- Target 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe
- Size 1.2MB
- Sample251208-tnn55seq4v
- SHA256 c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Malware Config
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
false
-
startup_directory_name
GLOZVJ
-
startup_env_name
appdata
-
startup_installation_name
GLOZVJ.exe
-
startup_reg_name
GLOZVJ
-
tor_pid
false
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
autC7C4.tmp
memory/64-13-0x0000000000400000-0x0000000000446000-memory.dmp
memory/64-16-0x0000000000400000-0x0000000000446000-memory.dmp
memory/64-15-0x0000000000400000-0x0000000000446000-memory.dmp
memory/64-14-0x0000000000400000-0x0000000000446000-memory.dmp
memory/64-17-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/64-18-0x0000000005760000-0x00000000057B4000-memory.dmp
memory/64-19-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/64-20-0x0000000005E90000-0x0000000006434000-memory.dmp
memory/64-21-0x0000000005800000-0x0000000005852000-memory.dmp
memory/64-37-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-105-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-139-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-137-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-135-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-133-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-131-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-129-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-1053-0x0000000005A50000-0x0000000005AB6000-memory.dmp
memory/64-1052-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/64-125-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-123-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-121-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-119-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-117-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-115-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-113-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-111-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-109-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-107-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-103-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-101-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-99-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-97-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-95-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-91-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-89-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-87-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-85-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-83-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-81-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-79-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-75-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-73-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-71-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-69-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-67-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-65-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-63-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-61-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-59-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-57-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-55-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-53-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-51-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-49-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-47-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-45-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-127-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-43-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-41-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-39-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-35-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-93-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-33-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-31-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-29-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-77-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-27-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-25-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-23-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-22-0x0000000005800000-0x000000000584D000-memory.dmp
memory/64-1054-0x0000000006830000-0x0000000006880000-memory.dmp
memory/64-1055-0x0000000006920000-0x00000000069B2000-memory.dmp
memory/64-1056-0x0000000006880000-0x000000000688A000-memory.dmp
memory/64-1057-0x0000000000400000-0x0000000000446000-memory.dmp
memory/64-1058-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/64-1059-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/2204-0-0x0000000000500000-0x000000000062C000-memory.dmp
memory/2204-12-0x00000000007C0000-0x00000000007C4000-memory.dmp