Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
- submitted
11/05/2026, 10:58
General
- Target 60108be8855018ed7458fcfbbd12b6dd930acee9f7158b8d94ddf0ad042d19d4.exe
- Size 959KB
- Sample260511-m2vrhsbt6k
- SHA256 60108be8855018ed7458fcfbbd12b6dd930acee9f7158b8d94ddf0ad042d19d4
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.strato.de
-
Port
587
-
Username
-
Password
Oy1)8JSu_qPx(rzV_{Xu
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.strato.de
-
Port
587
-
Username
-
Password
Oy1)8JSu_qPx(rzV_{Xu
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 4 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: SetClipboardViewer 2 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60108be8855018ed7458fcfbbd12b6dd930acee9f7158b8d94ddf0ad042d19d4.exe"C:\Users\Admin\AppData\Local\Temp\60108be8855018ed7458fcfbbd12b6dd930acee9f7158b8d94ddf0ad042d19d4.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\60108be8855018ed7458fcfbbd12b6dd930acee9f7158b8d94ddf0ad042d19d4.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\60108be8855018ed7458fcfbbd12b6dd930acee9f7158b8d94ddf0ad042d19d4.exe"C:\Users\Admin\AppData\Local\Temp\60108be8855018ed7458fcfbbd12b6dd930acee9f7158b8d94ddf0ad042d19d4.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\n50dnqkatwv.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CpeYgyxAc.exe"C:\Users\Admin\AppData\Roaming\CpeYgyxAc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CpeYgyxAc.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\CpeYgyxAc.exe"C:\Users\Admin\AppData\Roaming\CpeYgyxAc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Roaming\zNAKSP\zNAKSP.exeC:\Users\Admin\AppData\Roaming\zNAKSP\zNAKSP.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zNAKSP\zNAKSP.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\zNAKSP\zNAKSP.exe"C:\Users\Admin\AppData\Roaming\zNAKSP\zNAKSP.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
zNAKSP.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_unf1cscz.xeq.ps1
n50dnqkatwv.ps1
CpeYgyxAc.exe
memory/596-73-0x0000000005AF0000-0x0000000005B08000-memory.dmp
memory/596-25-0x0000000005350000-0x0000000005372000-memory.dmp
memory/596-72-0x00000000051D0000-0x00000000052BA000-memory.dmp
memory/596-71-0x0000000002870000-0x0000000002889000-memory.dmp
memory/596-67-0x0000000007870000-0x0000000007878000-memory.dmp
memory/596-19-0x0000000004D40000-0x0000000004D50000-memory.dmp
memory/596-18-0x00000000028B0000-0x00000000028E6000-memory.dmp
memory/596-23-0x0000000005380000-0x00000000059AA000-memory.dmp
memory/596-66-0x0000000007880000-0x000000000789A000-memory.dmp
memory/596-65-0x0000000007790000-0x00000000077A5000-memory.dmp
memory/596-64-0x0000000007780000-0x000000000778E000-memory.dmp
memory/596-57-0x00000000067E0000-0x00000000067FE000-memory.dmp
memory/596-26-0x0000000005B20000-0x0000000005B86000-memory.dmp
memory/596-63-0x0000000007740000-0x0000000007751000-memory.dmp
memory/596-33-0x0000000005E40000-0x0000000006197000-memory.dmp
memory/596-34-0x00000000061E0000-0x00000000061FE000-memory.dmp
memory/596-35-0x0000000006230000-0x000000000627C000-memory.dmp
memory/596-62-0x00000000077C0000-0x0000000007856000-memory.dmp
memory/596-61-0x00000000075B0000-0x00000000075BA000-memory.dmp
memory/596-60-0x0000000007530000-0x000000000754A000-memory.dmp
memory/596-59-0x0000000007B80000-0x00000000081FA000-memory.dmp
memory/596-49-0x00000000073B0000-0x00000000073E4000-memory.dmp
memory/596-50-0x00000000705D0000-0x000000007061C000-memory.dmp
memory/596-58-0x0000000007400000-0x00000000074A4000-memory.dmp
memory/1684-2-0x0000000004CD0000-0x0000000004D62000-memory.dmp
memory/1684-4-0x0000000004E50000-0x0000000004E5A000-memory.dmp
memory/1684-6-0x00000000026F0000-0x000000000278C000-memory.dmp
memory/1684-3-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/1684-9-0x0000000006D90000-0x0000000006E68000-memory.dmp
memory/1684-8-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/1684-7-0x0000000004D70000-0x0000000004E31000-memory.dmp
memory/1684-21-0x00000000026F0000-0x000000000278C000-memory.dmp
memory/1684-22-0x0000000004D70000-0x0000000004E31000-memory.dmp
memory/1684-1-0x00000000051E0000-0x0000000005786000-memory.dmp
memory/1684-5-0x0000000006910000-0x0000000006928000-memory.dmp
memory/1684-12-0x0000000004D70000-0x0000000004E31000-memory.dmp
memory/1684-0-0x0000000000090000-0x0000000000186000-memory.dmp
memory/1684-10-0x0000000006F10000-0x0000000006FAC000-memory.dmp
memory/2076-124-0x0000000005630000-0x0000000005697000-memory.dmp
memory/2076-125-0x0000000005760000-0x000000000576E000-memory.dmp
memory/2076-168-0x0000000005610000-0x000000000562E000-memory.dmp
memory/2076-170-0x0000000005760000-0x000000000576E000-memory.dmp
memory/2076-122-0x00000000050E0000-0x000000000517C000-memory.dmp
memory/2076-123-0x0000000005610000-0x000000000562E000-memory.dmp
memory/2192-100-0x00000000063F0000-0x0000000006747000-memory.dmp
memory/2192-116-0x00000000062A0000-0x00000000062B8000-memory.dmp
memory/2192-115-0x00000000058D0000-0x00000000059BA000-memory.dmp
memory/2192-102-0x00000000069B0000-0x00000000069FC000-memory.dmp
memory/2192-103-0x0000000070720000-0x000000007076C000-memory.dmp
memory/2192-110-0x0000000007BA0000-0x0000000007C44000-memory.dmp
memory/2192-111-0x0000000007F10000-0x0000000007F21000-memory.dmp
memory/2192-112-0x0000000007F50000-0x0000000007F65000-memory.dmp
memory/2192-114-0x0000000002E60000-0x0000000002E79000-memory.dmp
memory/2816-41-0x00000228F2220000-0x00000228F2242000-memory.dmp
memory/2816-48-0x00000228F21F0000-0x00000228F2202000-memory.dmp
memory/2832-121-0x0000000002330000-0x00000000023CC000-memory.dmp
memory/2832-139-0x0000000002330000-0x00000000023CC000-memory.dmp
memory/2900-161-0x00000000056F0000-0x00000000057DA000-memory.dmp
memory/2900-148-0x0000000006720000-0x000000000676C000-memory.dmp
memory/2900-156-0x0000000007990000-0x0000000007A34000-memory.dmp
memory/2900-157-0x0000000007C80000-0x0000000007C91000-memory.dmp
memory/2900-160-0x00000000015F0000-0x0000000001609000-memory.dmp
memory/2900-162-0x00000000058F0000-0x0000000005908000-memory.dmp
memory/2900-158-0x0000000007CC0000-0x0000000007CD5000-memory.dmp
memory/2900-146-0x00000000061B0000-0x0000000006507000-memory.dmp
memory/2900-149-0x0000000070410000-0x000000007045C000-memory.dmp
memory/3356-92-0x0000000004C90000-0x0000000004D2C000-memory.dmp
memory/3356-79-0x0000000004C90000-0x0000000004D2C000-memory.dmp
memory/5616-76-0x0000000006030000-0x0000000006097000-memory.dmp
memory/5616-118-0x0000000003430000-0x000000000344E000-memory.dmp
memory/5616-74-0x0000000005A50000-0x0000000005AEC000-memory.dmp
memory/5616-17-0x0000000000400000-0x0000000000444000-memory.dmp
memory/5616-120-0x0000000005B60000-0x0000000005B6E000-memory.dmp
memory/5616-24-0x0000000005AF0000-0x0000000005B56000-memory.dmp
memory/5616-78-0x0000000005CA0000-0x0000000005CB0000-memory.dmp
memory/5616-77-0x0000000005B60000-0x0000000005B6E000-memory.dmp
memory/5616-86-0x00000000072A0000-0x00000000072F0000-memory.dmp
memory/5616-75-0x0000000003430000-0x000000000344E000-memory.dmp
memory/5776-171-0x0000000005020000-0x00000000050BC000-memory.dmp
memory/5776-174-0x0000000005680000-0x000000000568E000-memory.dmp
memory/5776-173-0x0000000005450000-0x00000000054B7000-memory.dmp
memory/5776-172-0x0000000005430000-0x000000000544E000-memory.dmp