Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 06:03
General
- Target Guangzhou Seoca PO-2601055-110836.JS.js
- Size 4.7MB
- Sample260629-gr96kaev4v
- SHA256 daa53c3817696b4112be21e343aae4e17bc1be1d5dab1727cc55b157e6efb1d1
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.3dsportsgins.com
-
Port
21
-
Username
-
Password
([A}FQG_-z493;L4
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Guangzhou Seoca PO-2601055-110836.JS.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\ORWOQIUFROGLIZSW.PIF"C:\Users\Admin\Documents\ORWOQIUFROGLIZSW.PIF" C:\Users\Admin\Documents\ORWOQIUFROGLIZSW.ttf2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ORWOQIUFROGLIZSW.PIF
ORWOQIUFROGLIZSW.ttf
memory/5588-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-12-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/5588-17-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/5588-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-18-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/5588-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-251-0x0000000074412000-0x0000000074413000-memory.dmp
memory/5588-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/5588-252-0x000000002A140000-0x000000002A182000-memory.dmp
memory/5588-253-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/5588-254-0x000000002A300000-0x000000002A8BA000-memory.dmp
memory/5588-256-0x000000002A210000-0x000000002A276000-memory.dmp
memory/5588-257-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/5588-255-0x0000000074400000-0x0000000074BBC000-memory.dmp
memory/5588-258-0x000000002B610000-0x000000002B6A2000-memory.dmp
memory/5588-259-0x000000002B720000-0x000000002B770000-memory.dmp
memory/5588-260-0x000000002B7B0000-0x000000002B7BA000-memory.dmp
memory/5588-262-0x0000000074412000-0x0000000074413000-memory.dmp
memory/5588-263-0x0000000074400000-0x0000000074BBC000-memory.dmp