Analysis
- max time kernel
119s - max time network
121s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
05/09/2025, 14:16
General
- Target 6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625.exe
- Size 1.0MB
- Sample250905-rlcm8a1vcw
- SHA256 6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.iaa-airferight.com
-
Port
587
-
Username
-
Password
webmaster
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Drops startup file 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625.exe"C:\Users\Admin\AppData\Local\Temp\6a58063fd4bfe4c9fd2bb7b17216fe3353a358a404d8b162d8b6f2a9bfc7b625.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3776-0-0x0000000000540000-0x0000000000650000-memory.dmp
memory/3776-1-0x0000000005070000-0x000000000517E000-memory.dmp
memory/3776-2-0x00000000057E0000-0x0000000005D86000-memory.dmp
memory/3776-3-0x00000000052D0000-0x0000000005362000-memory.dmp
memory/3776-17-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-25-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-37-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-51-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-69-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-81-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-105-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-129-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-127-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-125-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-123-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-121-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-119-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-117-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-115-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-113-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-111-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-109-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-107-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-103-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-101-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-99-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-97-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-95-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-93-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-91-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-89-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-87-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-85-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-83-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-79-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-77-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-75-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-73-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-71-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-67-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-65-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-63-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-61-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-59-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-57-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-55-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-53-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-49-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-47-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-45-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-43-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-41-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-39-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-35-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-31-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-33-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-29-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-27-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-24-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-21-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-19-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-15-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-13-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-11-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-9-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-7-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-5-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-4-0x0000000005070000-0x0000000005178000-memory.dmp
memory/3776-2272-0x0000000005220000-0x0000000005230000-memory.dmp
memory/3776-2273-0x0000000005280000-0x00000000052C2000-memory.dmp
memory/3776-2274-0x00000000054E0000-0x0000000005520000-memory.dmp
memory/3776-2275-0x0000000005680000-0x00000000056CC000-memory.dmp
memory/3776-2276-0x0000000005220000-0x0000000005230000-memory.dmp
memory/4676-2280-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4676-2281-0x0000000002860000-0x0000000002870000-memory.dmp
memory/4676-2282-0x0000000004FC0000-0x0000000005026000-memory.dmp
memory/4676-2283-0x0000000006280000-0x00000000062D0000-memory.dmp
memory/4676-2284-0x00000000062E0000-0x00000000062EA000-memory.dmp
memory/4676-2285-0x0000000002860000-0x0000000002870000-memory.dmp