agenttesla | e308d1f65a8176b053bf9d3b22db9f7b5b2da73b49ec4271b2237b7728bf9592

Analysis

max time kernel
149s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
31/10/2025, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO-24110015.pif.exe
Size 782KB
Sample251031-p7dfjayrfy
SHA256 e308d1f65a8176b053bf9d3b22db9f7b5b2da73b49ec4271b2237b7728bf9592
MD5 a1e2868429952443cd3724bb50c935fe
SHA1 137633008ba28e911a3c6df827261e892a685484
SHA512 699dfeeb61bf36aaaf9815a1d651d4cec235eae90efe8f12c4472b7d94bb379b72010d970420bdb6a85e8503b1ac9b992b36f83c4169fbb635e25cf2e3821ea0
SSDEEP 12288:qnd3mqm3LuRuIjxqTTpx9q5IAeVM/ltn5vwyM45Y8ypxx1PA/C5JDFUGuMg0IsEV:2mrAxqfnaIAeVM7n5vWgY/pRPA2DFULd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.am-pek.com
Port
587
Username
[email protected]
Password
fuckyou
Email to
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Agenttesla family
agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5656	powershell.exe
5884	powershell.exe
8	powershell.exe
5088	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4640	UrbYzO.exe
5176	UrbYzO.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 2744	2272	PO-24110015.pif.exe	84
PID 4640 set thread context of 5176	4640	UrbYzO.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbYzO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbYzO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO-24110015.pif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO-24110015.pif.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
728	schtasks.exe
3716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2272	PO-24110015.pif.exe
5656	powershell.exe
5884	powershell.exe
2272	PO-24110015.pif.exe
2744	PO-24110015.pif.exe
2744	PO-24110015.pif.exe
5656	powershell.exe
5884	powershell.exe
4640	UrbYzO.exe
8	powershell.exe
5088	powershell.exe
4640	UrbYzO.exe
8	powershell.exe
5176	UrbYzO.exe
5176	UrbYzO.exe
5088	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	PO-24110015.pif.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	5884	powershell.exe
Token: SeDebugPrivilege	2744	PO-24110015.pif.exe
Token: SeDebugPrivilege	4640	UrbYzO.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	5176	UrbYzO.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 5656	2272	PO-24110015.pif.exe	78
PID 2272 wrote to memory of 5656	2272	PO-24110015.pif.exe	78
PID 2272 wrote to memory of 5656	2272	PO-24110015.pif.exe	78
PID 2272 wrote to memory of 5884	2272	PO-24110015.pif.exe	80
PID 2272 wrote to memory of 5884	2272	PO-24110015.pif.exe	80
PID 2272 wrote to memory of 5884	2272	PO-24110015.pif.exe	80
PID 2272 wrote to memory of 728	2272	PO-24110015.pif.exe	81
PID 2272 wrote to memory of 728	2272	PO-24110015.pif.exe	81
PID 2272 wrote to memory of 728	2272	PO-24110015.pif.exe	81
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 2272 wrote to memory of 2744	2272	PO-24110015.pif.exe	84
PID 4640 wrote to memory of 8	4640	UrbYzO.exe	88
PID 4640 wrote to memory of 8	4640	UrbYzO.exe	88
PID 4640 wrote to memory of 8	4640	UrbYzO.exe	88
PID 4640 wrote to memory of 5088	4640	UrbYzO.exe	90
PID 4640 wrote to memory of 5088	4640	UrbYzO.exe	90
PID 4640 wrote to memory of 5088	4640	UrbYzO.exe	90
PID 4640 wrote to memory of 3716	4640	UrbYzO.exe	91
PID 4640 wrote to memory of 3716	4640	UrbYzO.exe	91
PID 4640 wrote to memory of 3716	4640	UrbYzO.exe	91
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94
PID 4640 wrote to memory of 5176	4640	UrbYzO.exe	94

C:\Users\Admin\AppData\Local\Temp\PO-24110015.pif.exe
"C:\Users\Admin\AppData\Local\Temp\PO-24110015.pif.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-24110015.pif.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5656
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UrbYzO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5884
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UrbYzO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA3A2.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:728
- C:\Users\Admin\AppData\Local\Temp\PO-24110015.pif.exe
  "C:\Users\Admin\AppData\Local\Temp\PO-24110015.pif.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744

C:\Users\Admin\AppData\Roaming\UrbYzO.exe
C:\Users\Admin\AppData\Roaming\UrbYzO.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UrbYzO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UrbYzO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UrbYzO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEAAE.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3716
- C:\Users\Admin\AppData\Roaming\UrbYzO.exe
  "C:\Users\Admin\AppData\Roaming\UrbYzO.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 ead20c53d2ba4f4378f71d2229a504c312c0b8ee6c7d2c6212fe77f95975831b
MD5 f9a22eeee110675adbfb518d7b64ebb2
SHA1 cd6dcbb865f8c1f5ce12a5e678fa0708ea4b54fe
SHA512 21c274896a7014b6e25513618aeddf25d9d0e9ad379acc18d621c49d7d20fb082aa817bf3fbbeb03a57cae4957d2c2bc8ba9ab7df658861c97b91d4d06391490
SSDEEP 384:KWL3HhY1SGABjOFRHEME1qy7XHnnNGYaa8bpinofnSzRdAnYEImDU1C:KAWSj4RPE1qe3NGWIfnWd3yUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6d2119cc7fb7075a2f5e519890c29979d3c1fd66985a193b6327b1b4eec68653
MD5 2d936f3768e19baad8ec9376035eab91
SHA1 f881e9ca79239d4cfe5ab1c59ebc2504959ee79e
SHA512 3365774887390b4d2612092ef1c548397dd03e8317a3855866f34b0f6008cb088f3e5840c8e0f0dcfffc9157b11fb7869bc36e760cea9ca64eb281c41afb33f0
SSDEEP 384:iL3HhY1SS1fJCzhaFRHEMEWHnnNzjs2xtgDNS/o9F9Eou0iFZX:sWSS7MaRPEmNzj7xtgRSqF9Eou0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_1uvz43ja.0ih.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1uvz43ja.0ih.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpA3A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA3A2.tmp
Size 1KB
SHA256 13eec59b4bf335e4cdeea6212627db829ea8e551fa9cdb03bbc089dc7f3e06ba
MD5 f403b0676dd673b12a8339ea56eed8e9
SHA1 8c2abfeb216e6c9eb9c7da945bb12e6f1a802064
SHA512 55b93366cc38f5845505311c38122d1b433f70c5709410a8723f0f018a9c9a1b5cc3b089cd7ff44599befd76b7340acaf35db1e4af6f82d8aaa9139b7febb504
MD5 SHA1 SHA512

Submit Download

UrbYzO.exe

Path C:\Users\Admin\AppData\Roaming\UrbYzO.exe
Size 782KB
SHA256 e308d1f65a8176b053bf9d3b22db9f7b5b2da73b49ec4271b2237b7728bf9592
MD5 a1e2868429952443cd3724bb50c935fe
SHA1 137633008ba28e911a3c6df827261e892a685484
SHA512 699dfeeb61bf36aaaf9815a1d651d4cec235eae90efe8f12c4472b7d94bb379b72010d970420bdb6a85e8503b1ac9b992b36f83c4169fbb635e25cf2e3821ea0
SSDEEP 12288:qnd3mqm3LuRuIjxqTTpx9q5IAeVM/ltn5vwyM45Y8ypxx1PA/C5JDFUGuMg0IsEV:2mrAxqfnaIAeVM7n5vWgY/pRPA2DFULd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-100-0x0000000007280000-0x0000000007324000-memory.dmp

Download

memory/8-93-0x0000000071640000-0x000000007168C000-memory.dmp

Download

memory/2272-5-0x00000000056C0000-0x00000000056D2000-memory.dmp

Download

memory/2272-0-0x0000000000590000-0x0000000000656000-memory.dmp

Download

memory/2272-1-0x0000000005700000-0x0000000005CA6000-memory.dmp

Download

memory/2272-2-0x0000000005150000-0x00000000051E2000-memory.dmp

Download

memory/2272-7-0x0000000006810000-0x0000000006896000-memory.dmp

Download

memory/2272-3-0x00000000050E0000-0x00000000050F0000-memory.dmp

Download

memory/2272-6-0x00000000050E0000-0x00000000050F0000-memory.dmp

Download

memory/2272-8-0x0000000008E70000-0x0000000008F0C000-memory.dmp

Download

memory/2272-4-0x0000000005110000-0x000000000511A000-memory.dmp

Download

memory/2744-22-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2744-64-0x00000000067F0000-0x0000000006840000-memory.dmp

Download

memory/5088-82-0x0000000005F90000-0x00000000062E7000-memory.dmp

Download

memory/5088-101-0x0000000071640000-0x000000007168C000-memory.dmp

Download

memory/5088-108-0x0000000007A60000-0x0000000007A71000-memory.dmp

Download

memory/5088-109-0x0000000007A90000-0x0000000007AA5000-memory.dmp

Download

memory/5656-38-0x0000000005A90000-0x0000000005AAE000-memory.dmp

Download

memory/5656-21-0x00000000054D0000-0x0000000005536000-memory.dmp

Download

memory/5656-13-0x00000000022A0000-0x00000000022D6000-memory.dmp

Download

memory/5656-15-0x00000000022F0000-0x0000000002300000-memory.dmp

Download

memory/5656-14-0x00000000022F0000-0x0000000002300000-memory.dmp

Download

memory/5656-16-0x0000000004CD0000-0x00000000052FA000-memory.dmp

Download

memory/5656-52-0x0000000071640000-0x000000007168C000-memory.dmp

Download

memory/5656-59-0x0000000007420000-0x0000000007A9A000-memory.dmp

Download

memory/5656-60-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

Download

memory/5656-61-0x0000000006E60000-0x0000000006E6A000-memory.dmp

Download

memory/5656-62-0x0000000007070000-0x0000000007106000-memory.dmp

Download

memory/5656-39-0x0000000006020000-0x000000000606C000-memory.dmp

Download

memory/5656-25-0x00000000055B0000-0x0000000005907000-memory.dmp

Download

memory/5656-23-0x0000000005540000-0x00000000055A6000-memory.dmp

Download

memory/5656-66-0x0000000007030000-0x0000000007045000-memory.dmp

Download

memory/5656-67-0x0000000007130000-0x000000000714A000-memory.dmp

Download

memory/5656-20-0x00000000053B0000-0x00000000053D2000-memory.dmp

Download

memory/5884-68-0x0000000007130000-0x0000000007138000-memory.dmp

Download

memory/5884-65-0x0000000007030000-0x000000000703E000-memory.dmp

Download

memory/5884-63-0x0000000007000000-0x0000000007011000-memory.dmp

Download

memory/5884-18-0x0000000002310000-0x0000000002320000-memory.dmp

Download

memory/5884-17-0x0000000002310000-0x0000000002320000-memory.dmp

Download

memory/5884-50-0x0000000006A90000-0x0000000006AAE000-memory.dmp

Download

memory/5884-51-0x0000000006AC0000-0x0000000006B64000-memory.dmp

Download

memory/5884-43-0x0000000071640000-0x000000007168C000-memory.dmp

Download

memory/5884-42-0x0000000006A50000-0x0000000006A84000-memory.dmp

Download