Analysis
- max time kernel
149s - max time network
106s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
08/12/2025, 16:12
General
- Target 227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe
- Size 1.2MB
- Sample251208-tnn55seq4v
- SHA256 c51687fb524469a5e1cc2a67c2e43691decf8a844cc7827cfdf276da1f00f153
Malware Config
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
false
-
startup_directory_name
GLOZVJ
-
startup_env_name
appdata
-
startup_installation_name
GLOZVJ.exe
-
startup_reg_name
GLOZVJ
-
tor_pid
false
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\227a4456fb01401663152a26fe350696552d9e8b6800b0ae740f651537f51225.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 240 -s 7523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 240 -ip 2401⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
apostrophise
aut886A.tmp
memory/240-13-0x0000000000400000-0x000000000052C000-memory.dmp
memory/1908-27-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1908-28-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1908-29-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1908-30-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1908-31-0x0000000005200000-0x0000000005210000-memory.dmp
memory/1908-32-0x0000000002900000-0x0000000002954000-memory.dmp
memory/1908-33-0x0000000005200000-0x0000000005210000-memory.dmp
memory/1908-34-0x00000000057C0000-0x0000000005D66000-memory.dmp
memory/1908-35-0x0000000005090000-0x00000000050E2000-memory.dmp
memory/1908-41-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-101-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-125-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-151-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-149-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-147-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-145-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-143-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-141-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-139-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-137-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-135-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-133-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-131-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-129-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-127-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-123-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-121-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-119-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-117-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-113-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-111-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-109-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-107-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-106-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-103-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-99-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-97-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-95-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-93-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-89-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-87-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-85-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-83-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-81-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-79-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-77-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-75-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-73-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-71-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-69-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-65-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-63-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-62-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-59-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-57-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-55-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-53-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-51-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-47-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-45-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-43-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-115-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-91-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-39-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-67-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-37-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-36-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-50-0x0000000005090000-0x00000000050DD000-memory.dmp
memory/1908-1066-0x0000000005200000-0x0000000005210000-memory.dmp
memory/1908-1067-0x0000000005190000-0x00000000051F6000-memory.dmp
memory/1908-1068-0x0000000006110000-0x0000000006160000-memory.dmp
memory/1908-1069-0x0000000006200000-0x0000000006292000-memory.dmp
memory/1908-1070-0x00000000060A0000-0x00000000060AA000-memory.dmp
memory/1908-1071-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1908-1072-0x0000000005200000-0x0000000005210000-memory.dmp
memory/1908-1073-0x0000000005200000-0x0000000005210000-memory.dmp
memory/1908-1074-0x0000000005200000-0x0000000005210000-memory.dmp
memory/2720-0-0x0000000000400000-0x000000000052C000-memory.dmp
memory/2720-12-0x00000000025B0000-0x00000000025B4000-memory.dmp