Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/04/2026, 10:37
General
- Target DON KUL.exe
- Size 1.2MB
- Sample260401-mnxc7aet6x
- SHA256 830e7555a21ef8eaf7c0476595d116806d5351e5e6d1e458f10cf9e7e93d7dd9
Malware Config
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
true
-
enable_cookies
true
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
2
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
true
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
startup_directory_name
eXCXES
-
startup_env_name
appdata
-
startup_installation_name
eXCXES.exe
-
startup_reg_name
eXCXES
-
tor_pid
false
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DON KUL.exe"C:\Users\Admin\AppData\Local\Temp\DON KUL.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\DON KUL.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3960-4-0x0000000002390000-0x0000000002394000-memory.dmp
memory/3960-9-0x0000000000C80000-0x0000000000D3B000-memory.dmp
memory/4948-5-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-6-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-8-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-7-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-10-0x0000000005C60000-0x0000000005C70000-memory.dmp
memory/4948-11-0x0000000005B60000-0x0000000005BB6000-memory.dmp
memory/4948-12-0x0000000006220000-0x00000000067C6000-memory.dmp
memory/4948-13-0x0000000005BF0000-0x0000000005C44000-memory.dmp
memory/4948-14-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-19-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-127-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-131-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-129-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-125-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-123-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-121-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-119-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-117-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-113-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-111-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-109-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-107-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-105-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-103-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-101-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-99-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-97-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-93-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-91-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-89-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-87-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-85-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-83-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-81-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-79-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-75-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-73-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-71-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-69-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-67-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-65-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-63-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-61-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-59-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-57-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-55-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-53-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-49-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-47-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-45-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-43-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-41-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-39-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-37-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-35-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-33-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-31-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-27-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-25-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-23-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-21-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-17-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-15-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-115-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-95-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-77-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-51-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-29-0x0000000005BF0000-0x0000000005C3E000-memory.dmp
memory/4948-1084-0x0000000005C60000-0x0000000005C70000-memory.dmp
memory/4948-1085-0x0000000005DE0000-0x0000000005E46000-memory.dmp
memory/4948-1086-0x0000000007850000-0x00000000078A0000-memory.dmp
memory/4948-1087-0x0000000007950000-0x00000000079E2000-memory.dmp
memory/4948-1088-0x00000000078F0000-0x00000000078FA000-memory.dmp
memory/4948-1089-0x0000000000400000-0x0000000000446000-memory.dmp
memory/4948-1090-0x0000000005C60000-0x0000000005C70000-memory.dmp
memory/4948-1091-0x0000000005C60000-0x0000000005C70000-memory.dmp
memory/4948-1094-0x0000000005C60000-0x0000000005C70000-memory.dmp
memory/4948-1095-0x0000000005C60000-0x0000000005C70000-memory.dmp