Analysis
- max time kernel
121s - max time network
106s - platform
windows11-21h2_x64 - resource
win11-20250508-en - resource tags
- submitted
10/06/2025, 09:19
General
- Target 98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617.exe
- Size 81KB
- Sample250610-laa3cssxc1
- SHA256 98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.iaa-airferight.com
-
Port
587
-
Username
-
Password
Asaprocky11
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Drops startup file 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617.exe"C:\Users\Admin\AppData\Local\Temp\98f48787c509487f71e7fe1af189d4b2715f3d16cb7609a67ca87c290fcfb617.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAOQA4AGYANAA4ADcAOAA3AGMANQAwADkANAA4ADcAZgA3ADEAZQA3AGYAZQAxAGEAZgAxADgAOQBkADQAYgAyADcAMQA1AGYAMwBkADEANgBjAGIANwA2ADAAOQBhADYANwBjAGEAOAA3AGMAMgA5ADAAZgBjAGYAYgA2ADEANwAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAA5ADgAZgA0ADgANwA4ADcAYwA1ADAAOQA0ADgANwBmADcAMQBlADcAZgBlADEAYQBmADEAOAA5AGQANABiADIANwAxADUAZgAzAGQAMQA2AGMAYgA3ADYAMAA5AGEANgA3AGMAYQA4ADcAYwAyADkAMABmAGMAZgBiADYAMQA3AC4AZQB4AGUAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABwAGQAZgAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABwAGQAZgAuAGUAeABlAA==2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_30ompaj5.3yf.ps1
memory/916-16-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-6021-0x00000000057A0000-0x00000000057EC000-memory.dmp
memory/916-2-0x0000000075050000-0x0000000075801000-memory.dmp
memory/916-3-0x000000007505E000-0x000000007505F000-memory.dmp
memory/916-4-0x0000000006B00000-0x0000000006DE8000-memory.dmp
memory/916-5-0x0000000007400000-0x00000000079A6000-memory.dmp
memory/916-8-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-7-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-14-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-26-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-31-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-41-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-53-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-71-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-12-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-65-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-57-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-55-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-69-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-63-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-61-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-59-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-52-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-49-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-47-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-45-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-43-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-37-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-33-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-39-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-35-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-29-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-28-0x0000000075050000-0x0000000075801000-memory.dmp
memory/916-24-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-22-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-20-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-18-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-0-0x000000007505E000-0x000000007505F000-memory.dmp
memory/916-67-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-1-0x0000000000C20000-0x0000000000C3A000-memory.dmp
memory/916-6-0x0000000006F50000-0x0000000006FE2000-memory.dmp
memory/916-6018-0x0000000075050000-0x0000000075801000-memory.dmp
memory/916-6019-0x0000000005680000-0x00000000056EC000-memory.dmp
memory/916-6020-0x0000000005710000-0x000000000577A000-memory.dmp
memory/916-10-0x0000000006B00000-0x0000000006DE1000-memory.dmp
memory/916-6022-0x0000000075050000-0x0000000075801000-memory.dmp
memory/916-6068-0x0000000006980000-0x00000000069D4000-memory.dmp
memory/916-6075-0x0000000075050000-0x0000000075801000-memory.dmp
memory/4140-6073-0x0000000006B80000-0x0000000006BD0000-memory.dmp
memory/4140-6074-0x0000000006E10000-0x0000000006E1A000-memory.dmp
memory/4140-6072-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4592-6043-0x0000000070080000-0x00000000700CC000-memory.dmp
memory/4592-6042-0x0000000007440000-0x0000000007474000-memory.dmp
memory/4592-6027-0x0000000075050000-0x0000000075801000-memory.dmp
memory/4592-6025-0x00000000056A0000-0x0000000005CCA000-memory.dmp
memory/4592-6028-0x00000000054E0000-0x0000000005502000-memory.dmp
memory/4592-6029-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/4592-6030-0x0000000005CD0000-0x0000000005D36000-memory.dmp
memory/4592-6036-0x0000000005D80000-0x00000000060D7000-memory.dmp
memory/4592-6040-0x0000000006290000-0x00000000062AE000-memory.dmp
memory/4592-6041-0x00000000062C0000-0x000000000630C000-memory.dmp
memory/4592-6024-0x0000000075050000-0x0000000075801000-memory.dmp
memory/4592-6044-0x0000000075050000-0x0000000075801000-memory.dmp
memory/4592-6054-0x0000000007480000-0x0000000007524000-memory.dmp
memory/4592-6026-0x0000000075050000-0x0000000075801000-memory.dmp
memory/4592-6053-0x0000000006860000-0x000000000687E000-memory.dmp
memory/4592-6055-0x0000000075050000-0x0000000075801000-memory.dmp
memory/4592-6057-0x00000000075E0000-0x00000000075FA000-memory.dmp
memory/4592-6056-0x0000000007C20000-0x000000000829A000-memory.dmp
memory/4592-6058-0x0000000007660000-0x000000000766A000-memory.dmp
memory/4592-6059-0x0000000007870000-0x0000000007906000-memory.dmp
memory/4592-6060-0x00000000077F0000-0x0000000007801000-memory.dmp
memory/4592-6061-0x0000000007820000-0x000000000782E000-memory.dmp
memory/4592-6023-0x0000000002DC0000-0x0000000002DF6000-memory.dmp
memory/4592-6062-0x0000000007830000-0x0000000007845000-memory.dmp
memory/4592-6063-0x0000000007930000-0x000000000794A000-memory.dmp
memory/4592-6064-0x0000000007920000-0x0000000007928000-memory.dmp
memory/4592-6067-0x0000000075050000-0x0000000075801000-memory.dmp