Analysis
- max time kernel
123s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
09/10/2025, 14:03
General
- Target 8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d.exe
- Size 839KB
- Sample251009-rcndcsen51
- SHA256 8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.gmail.com
-
Port
587
-
Username
-
Password
ooasieiadccnxarj
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
true
-
startup_directory_name
gnxLZ
-
startup_env_name
appdata
-
startup_installation_name
gnxLZ.exe
-
startup_reg_name
gnxLZ
-
tor_pid
false
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d.exe"C:\Users\Admin\AppData\Local\Temp\8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d.exe"C:\Users\Admin\AppData\Local\Temp\8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
8bc293957dc7682c4e0d265a34af321e71c533e41c93ee31e5d8cd5a23be9e7d.exe.log
__PSScriptPolicyTest_jmlynytx.bxc.ps1
memory/2652-89-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-24-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-836-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-833-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-834-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-835-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-832-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2652-9-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2652-12-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2652-11-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2652-10-0x0000000000400000-0x0000000000460000-memory.dmp
memory/2652-827-0x00000000070F0000-0x0000000007140000-memory.dmp
memory/2652-15-0x0000000003360000-0x00000000033B4000-memory.dmp
memory/2652-18-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-17-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-27-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-34-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-35-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-16-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-45-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-23-0x00000000058A0000-0x00000000058F4000-memory.dmp
memory/2652-137-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-143-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-65-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-83-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-105-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-141-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-109-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-87-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-25-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-795-0x0000000005900000-0x0000000005901000-memory.dmp
memory/2652-794-0x00000000059B0000-0x00000000059C0000-memory.dmp
memory/2652-139-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-135-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-133-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-131-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-129-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-127-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-85-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-123-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-121-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-119-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-117-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-115-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-113-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-111-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-29-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-103-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-101-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-99-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-97-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-95-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-93-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-91-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-107-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-31-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-125-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-81-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-79-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-77-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-75-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-73-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-71-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-69-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-67-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-63-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-61-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-59-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-57-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-55-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-53-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-51-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-49-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-47-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-43-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-41-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-39-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/2652-37-0x00000000058A0000-0x00000000058ED000-memory.dmp
memory/3344-2-0x0000000005150000-0x00000000051E2000-memory.dmp
memory/3344-0-0x0000000000640000-0x0000000000716000-memory.dmp
memory/3344-4-0x0000000005120000-0x000000000512A000-memory.dmp
memory/3344-5-0x00000000053B0000-0x000000000544C000-memory.dmp
memory/3344-3-0x0000000005300000-0x0000000005310000-memory.dmp
memory/3344-1-0x0000000005620000-0x0000000005BC4000-memory.dmp
memory/3344-6-0x0000000005580000-0x0000000005598000-memory.dmp
memory/3344-7-0x0000000005300000-0x0000000005310000-memory.dmp
memory/3344-8-0x0000000006410000-0x00000000064B6000-memory.dmp
memory/4064-168-0x0000000005980000-0x00000000059E6000-memory.dmp
memory/4064-823-0x0000000007670000-0x0000000007706000-memory.dmp
memory/4064-20-0x0000000004B10000-0x0000000004B46000-memory.dmp
memory/4064-21-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/4064-808-0x0000000070D20000-0x0000000070D6C000-memory.dmp
memory/4064-807-0x00000000066A0000-0x00000000066D2000-memory.dmp
memory/4064-805-0x00000000060D0000-0x00000000060EE000-memory.dmp
memory/4064-819-0x00000000072A0000-0x0000000007343000-memory.dmp
memory/4064-818-0x0000000006680000-0x000000000669E000-memory.dmp
memory/4064-821-0x00000000073F0000-0x000000000740A000-memory.dmp
memory/4064-822-0x0000000007470000-0x000000000747A000-memory.dmp
memory/4064-19-0x00000000026F0000-0x0000000002700000-memory.dmp
memory/4064-824-0x00000000075F0000-0x0000000007601000-memory.dmp
memory/4064-825-0x0000000007620000-0x000000000762E000-memory.dmp
memory/4064-826-0x0000000007630000-0x0000000007644000-memory.dmp
memory/4064-22-0x0000000005180000-0x00000000057A8000-memory.dmp
memory/4064-828-0x0000000007730000-0x000000000774A000-memory.dmp
memory/4064-829-0x0000000007710000-0x0000000007718000-memory.dmp
memory/4064-820-0x0000000007A40000-0x00000000080BA000-memory.dmp
memory/4064-167-0x0000000005860000-0x00000000058C6000-memory.dmp
memory/4064-319-0x0000000005AF0000-0x0000000005E44000-memory.dmp
memory/4064-806-0x00000000061A0000-0x00000000061EC000-memory.dmp
memory/4064-166-0x0000000005010000-0x0000000005032000-memory.dmp