Analysis
- max time kernel
93s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/01/2025, 14:08
General
- Target e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe
- Size 807KB
- Sample250110-rfk3eaylbp
- SHA256 e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.privateemail.com
-
Port
587
-
Username
-
Password
payment1759
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.privateemail.com
-
Port
587
-
Username
-
Password
payment1759
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe"C:\Users\Admin\AppData\Local\Temp\e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe"C:\Users\Admin\AppData\Local\Temp\e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
e26b0860871046c78f03c38d50b4208dab3478c2decfd616ec8fcc4ed9986602.exe.log
__PSScriptPolicyTest_dd0xbln2.tu5.ps1
memory/1824-11-0x0000000000400000-0x0000000000440000-memory.dmp
memory/1824-31-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1824-19-0x0000000005A30000-0x0000000005A96000-memory.dmp
memory/1824-53-0x00000000070B0000-0x0000000007100000-memory.dmp
memory/1824-61-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1824-14-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/2448-5-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/2448-9-0x00000000083D0000-0x0000000008452000-memory.dmp
memory/2448-10-0x000000000AB70000-0x000000000AC0C000-memory.dmp
memory/2448-8-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/2448-7-0x00000000747CE000-0x00000000747CF000-memory.dmp
memory/2448-15-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/2448-6-0x0000000006FF0000-0x0000000007008000-memory.dmp
memory/2448-0-0x00000000747CE000-0x00000000747CF000-memory.dmp
memory/2448-4-0x0000000005B50000-0x0000000005B5A000-memory.dmp
memory/2448-3-0x0000000005990000-0x0000000005A22000-memory.dmp
memory/2448-2-0x0000000005E60000-0x0000000006404000-memory.dmp
memory/2448-1-0x0000000000EE0000-0x0000000000FAE000-memory.dmp
memory/4380-20-0x0000000005210000-0x0000000005232000-memory.dmp
memory/4380-49-0x00000000074F0000-0x000000000750A000-memory.dmp
memory/4380-32-0x0000000005C20000-0x0000000005F74000-memory.dmp
memory/4380-18-0x0000000005410000-0x0000000005A38000-memory.dmp
memory/4380-33-0x00000000061D0000-0x00000000061EE000-memory.dmp
memory/4380-34-0x00000000062A0000-0x00000000062EC000-memory.dmp
memory/4380-36-0x0000000070440000-0x000000007048C000-memory.dmp
memory/4380-35-0x00000000067A0000-0x00000000067D2000-memory.dmp
memory/4380-46-0x0000000007190000-0x00000000071AE000-memory.dmp
memory/4380-47-0x00000000071C0000-0x0000000007263000-memory.dmp
memory/4380-48-0x0000000007B30000-0x00000000081AA000-memory.dmp
memory/4380-21-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/4380-50-0x0000000007560000-0x000000000756A000-memory.dmp
memory/4380-51-0x0000000007770000-0x0000000007806000-memory.dmp
memory/4380-52-0x00000000076F0000-0x0000000007701000-memory.dmp
memory/4380-17-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/4380-54-0x0000000007720000-0x000000000772E000-memory.dmp
memory/4380-55-0x0000000007730000-0x0000000007744000-memory.dmp
memory/4380-56-0x0000000007830000-0x000000000784A000-memory.dmp
memory/4380-57-0x0000000007810000-0x0000000007818000-memory.dmp
memory/4380-60-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/4380-16-0x00000000028A0000-0x00000000028D6000-memory.dmp