Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
12/10/2025, 19:33
General
- Target PO-0839380292.exe
- Size 635KB
- Sample251012-x9vftseq31
- SHA256 3cc8ebdc770eed05864ce67f642df1d35a59005ee108fbeba205cf8e9f27f514
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.fosna.net
-
Port
21
-
Username
-
Password
(=8fPSH$KO_!
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-0839380292.exe"C:\Users\Admin\AppData\Local\Temp\PO-0839380292.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-0839380292.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PO-0839380292.exe"C:\Users\Admin\AppData\Local\Temp\PO-0839380292.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PO-0839380292.exe.log
__PSScriptPolicyTest_pzvlybub.yqn.ps1
memory/2980-39-0x00000000071A0000-0x0000000007244000-memory.dmp
memory/2980-27-0x0000000005F60000-0x0000000005F7E000-memory.dmp
memory/2980-40-0x0000000007900000-0x0000000007F7A000-memory.dmp
memory/2980-48-0x0000000007600000-0x0000000007608000-memory.dmp
memory/2980-47-0x0000000007610000-0x000000000762A000-memory.dmp
memory/2980-46-0x0000000007520000-0x0000000007535000-memory.dmp
memory/2980-45-0x0000000007510000-0x000000000751E000-memory.dmp
memory/2980-26-0x0000000005B20000-0x0000000005E77000-memory.dmp
memory/2980-44-0x00000000074D0000-0x00000000074E1000-memory.dmp
memory/2980-12-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2980-13-0x0000000002750000-0x0000000002786000-memory.dmp
memory/2980-38-0x0000000007120000-0x000000000713E000-memory.dmp
memory/2980-29-0x0000000007160000-0x0000000007194000-memory.dmp
memory/2980-14-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
memory/2980-17-0x00000000054F0000-0x0000000005B1A000-memory.dmp
memory/2980-18-0x00000000051F0000-0x0000000005212000-memory.dmp
memory/2980-43-0x0000000007550000-0x00000000075E6000-memory.dmp
memory/2980-19-0x0000000005290000-0x00000000052F6000-memory.dmp
memory/2980-42-0x0000000007340000-0x000000000734A000-memory.dmp
memory/2980-41-0x00000000072C0000-0x00000000072DA000-memory.dmp
memory/2980-28-0x00000000064F0000-0x000000000653C000-memory.dmp
memory/2980-30-0x0000000070B40000-0x0000000070B8C000-memory.dmp
memory/3324-33-0x0000000006C60000-0x0000000006CB0000-memory.dmp
memory/3324-16-0x00000000057A0000-0x0000000005806000-memory.dmp
memory/3324-15-0x0000000005710000-0x0000000005720000-memory.dmp
memory/3324-9-0x0000000000400000-0x0000000000442000-memory.dmp
memory/3324-51-0x0000000005710000-0x0000000005720000-memory.dmp
memory/5672-3-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
memory/5672-0-0x0000000000E00000-0x0000000000EA6000-memory.dmp
memory/5672-1-0x0000000005F10000-0x00000000064B6000-memory.dmp
memory/5672-2-0x0000000005960000-0x00000000059F2000-memory.dmp
memory/5672-8-0x00000000074C0000-0x0000000007546000-memory.dmp
memory/5672-7-0x0000000005AD0000-0x0000000005AE0000-memory.dmp
memory/5672-6-0x0000000005C10000-0x0000000005C1C000-memory.dmp
memory/5672-5-0x0000000005C40000-0x0000000005CDC000-memory.dmp
memory/5672-4-0x0000000005A00000-0x0000000005A0A000-memory.dmp