Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
22/06/2026, 16:11
General
- Target _507224977a9112b74ca87ea08828259c15d39bd9744d6a71416d5e3500939b01.js
- Size 3.2MB
- Sample260622-tm9epaev7v
- SHA256 507224977a9112b74ca87ea08828259c15d39bd9744d6a71416d5e3500939b01
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.enogcaen-br.com
-
Port
21
-
Username
-
Password
[8GQf=87B[+#jMZc
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\_507224977a9112b74ca87ea08828259c15d39bd9744d6a71416d5e3500939b01.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\NPMDKIAELMIKEVLA.PIF"C:\Users\Admin\Documents\NPMDKIAELMIKEVLA.PIF" C:\Users\Admin\Documents\NPMDKIAELMIKEVLA.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
NPMDKIAELMIKEVLA.PIF
NPMDKIAELMIKEVLA.ttf
memory/1648-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-12-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
memory/1648-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-18-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
memory/1648-17-0x0000000000CE0000-0x0000000000CE1000-memory.dmp
memory/1648-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/1648-246-0x00000000748A2000-0x00000000748A3000-memory.dmp
memory/1648-247-0x0000000003BF0000-0x0000000003C32000-memory.dmp
memory/1648-248-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1648-249-0x000000002A330000-0x000000002A8EA000-memory.dmp
memory/1648-250-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1648-251-0x0000000003C80000-0x0000000003CE6000-memory.dmp
memory/1648-252-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1648-253-0x0000000074890000-0x000000007504C000-memory.dmp
memory/1648-254-0x000000002B450000-0x000000002B4E2000-memory.dmp
memory/1648-255-0x000000002B560000-0x000000002B5B0000-memory.dmp
memory/1648-256-0x000000002B600000-0x000000002B60A000-memory.dmp
memory/1648-257-0x00000000748A2000-0x00000000748A3000-memory.dmp
memory/1648-258-0x0000000074890000-0x000000007504C000-memory.dmp