Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
20/10/2025, 12:30
General
- Target Conferma di pagamento.exe
- Size 835KB
- Sample251020-pptd2atlap
- SHA256 cd136f5f464244be32e5443c06dda5e78f0b6c49ef566232ce680f4402429cb8
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.dongjln.com
-
Port
587
-
Username
-
Password
LILKOOLL14!
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.dongjln.com
-
Port
587
-
Username
-
Password
LILKOOLL14!
-
Email to
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Conferma di pagamento.exe"C:\Users\Admin\AppData\Local\Temp\Conferma di pagamento.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle minimized "$Formskringen = gc -raw 'C:\Users\Admin\AppData\Roaming\microtelephone\heliodor\Diskenspringernes.Lil' ; $Shaine=$Formskringen.SubString(76575,3);$Cyclospondyli++; .$Shaine($Formskringen)2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Badlisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kr5ebfxs.zob.ps1
Diskenspringernes.Lil
Mimre.bra
memory/3112-65-0x0000000007280000-0x000000000728A000-memory.dmp
memory/3112-53-0x0000000007070000-0x00000000070A4000-memory.dmp
memory/3112-35-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/3112-36-0x0000000005700000-0x0000000005766000-memory.dmp
memory/3112-33-0x0000000005060000-0x000000000568A000-memory.dmp
memory/3112-43-0x0000000005770000-0x0000000005AC7000-memory.dmp
memory/3112-44-0x0000000005C60000-0x0000000005C7E000-memory.dmp
memory/3112-45-0x0000000005D00000-0x0000000005D4C000-memory.dmp
memory/3112-46-0x0000000006C40000-0x0000000006CD6000-memory.dmp
memory/3112-47-0x0000000006160000-0x000000000617A000-memory.dmp
memory/3112-48-0x00000000061C0000-0x00000000061E2000-memory.dmp
memory/3112-49-0x00000000074C0000-0x0000000007A66000-memory.dmp
memory/3112-32-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-68-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-52-0x000000007FD30000-0x000000007FD40000-memory.dmp
memory/3112-67-0x0000000007430000-0x000000000743E000-memory.dmp
memory/3112-54-0x000000006FE00000-0x000000006FE4C000-memory.dmp
memory/3112-63-0x00000000070D0000-0x00000000070EE000-memory.dmp
memory/3112-62-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-60-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-64-0x0000000007180000-0x0000000007224000-memory.dmp
memory/3112-30-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-34-0x0000000004EC0000-0x0000000004EE2000-memory.dmp
memory/3112-66-0x0000000007400000-0x0000000007411000-memory.dmp
memory/3112-51-0x00000000080F0000-0x000000000876A000-memory.dmp
memory/3112-69-0x0000000007450000-0x0000000007465000-memory.dmp
memory/3112-70-0x0000000007490000-0x00000000074AA000-memory.dmp
memory/3112-71-0x0000000007480000-0x0000000007488000-memory.dmp
memory/3112-72-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-73-0x0000000007A80000-0x0000000007AAA000-memory.dmp
memory/3112-74-0x0000000007AB0000-0x0000000007AD4000-memory.dmp
memory/3112-75-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-77-0x000000007FD30000-0x000000007FD40000-memory.dmp
memory/3112-79-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-78-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3112-31-0x00000000027A0000-0x00000000027D6000-memory.dmp
memory/3112-81-0x0000000007B90000-0x0000000007B92000-memory.dmp
memory/3112-82-0x0000000008770000-0x000000000C23F000-memory.dmp
memory/3112-84-0x0000000004A20000-0x0000000004A30000-memory.dmp
memory/3964-85-0x0000000000A00000-0x0000000001D17000-memory.dmp
memory/3964-86-0x0000000000A00000-0x0000000000A44000-memory.dmp
memory/3964-87-0x0000000024250000-0x00000000242E2000-memory.dmp
memory/3964-88-0x0000000023C10000-0x0000000023C60000-memory.dmp
memory/3964-89-0x0000000024390000-0x000000002442C000-memory.dmp
memory/3964-92-0x0000000024550000-0x000000002455A000-memory.dmp