Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
06/11/2025, 11:08
General
- Target dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751.exe
- Size 738KB
- Sample251106-m8ptvawkgl
- SHA256 dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751
Malware Config
Extracted
-
agenttesla
-
https://api.telegram.org/bot8402070841:AAHRL8Fa0gXoFLnkAww-SeReimKPZxKH9Xo/
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751.exe"C:\Users\Admin\AppData\Local\Temp\dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751.exe"C:\Users\Admin\AppData\Local\Temp\dbecf6e2bad4b37d6d724a33c84bd1826dbd4f6eb0c490ef152b261c67edc751.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_n4kso0ub.fe1.ps1
memory/2300-0-0x0000000000820000-0x00000000008DE000-memory.dmp
memory/2300-1-0x0000000005960000-0x0000000005F06000-memory.dmp
memory/2300-2-0x00000000053B0000-0x0000000005442000-memory.dmp
memory/2300-3-0x0000000005610000-0x0000000005620000-memory.dmp
memory/2300-4-0x0000000005380000-0x000000000538A000-memory.dmp
memory/2300-5-0x0000000005620000-0x00000000056BC000-memory.dmp
memory/2300-6-0x0000000006AC0000-0x0000000006AD6000-memory.dmp
memory/2300-7-0x0000000006B40000-0x0000000006BC6000-memory.dmp
memory/4860-15-0x0000000005480000-0x0000000005AAA000-memory.dmp
memory/4860-26-0x0000000006130000-0x000000000617C000-memory.dmp
memory/4860-45-0x0000000007780000-0x000000000779A000-memory.dmp
memory/4860-14-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/4860-12-0x00000000028D0000-0x0000000002906000-memory.dmp
memory/4860-43-0x0000000007670000-0x000000000767E000-memory.dmp
memory/4860-16-0x0000000005250000-0x0000000005272000-memory.dmp
memory/4860-17-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/4860-46-0x0000000007770000-0x0000000007778000-memory.dmp
memory/4860-24-0x0000000005BC0000-0x0000000005F17000-memory.dmp
memory/4860-25-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/4860-11-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/4860-27-0x00000000072A0000-0x00000000072D4000-memory.dmp
memory/4860-28-0x0000000070FA0000-0x0000000070FEC000-memory.dmp
memory/4860-35-0x00000000072E0000-0x00000000072FE000-memory.dmp
memory/4860-36-0x0000000007300000-0x00000000073A4000-memory.dmp
memory/4860-37-0x0000000007A80000-0x00000000080FA000-memory.dmp
memory/4860-38-0x0000000007430000-0x000000000744A000-memory.dmp
memory/4860-44-0x0000000007680000-0x0000000007695000-memory.dmp
memory/4860-40-0x00000000074B0000-0x00000000074BA000-memory.dmp
memory/4860-41-0x00000000076C0000-0x0000000007756000-memory.dmp
memory/4860-42-0x0000000007640000-0x0000000007651000-memory.dmp
memory/5716-10-0x0000000005B10000-0x0000000005B20000-memory.dmp
memory/5716-39-0x0000000006920000-0x0000000006970000-memory.dmp
memory/5716-13-0x0000000005B20000-0x0000000005B86000-memory.dmp
memory/5716-8-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5716-49-0x0000000005B10000-0x0000000005B20000-memory.dmp