Analysis
- max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 15:01
General
- Target output_g7ss7xmq.js
- Size 1.7MB
- Sample260702-sd1kradx4l
- SHA256 9d132e36a9bf5385e2392eaad7e0b9ccbd14242bbcca422b160b61a22c580682
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.corwineagles.com
-
Port
21
-
Username
-
Password
-DHG8CfN^;]q
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\output_g7ss7xmq.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -WindowStyle Hidden -w h -NOP -Noni -Command "iex $env:NY9QoQr3LxL"2⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -w h -NOP -Noni -Command "iex $env:NY9QoQr3LxL"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Registers new Windows logon scripts automatically executed at logon.
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_es4p2ct3.cd5.ps1
memory/2560-18-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-14-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-7-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-8-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-10-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-11-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-12-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-17-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-0-0x00007FFE1217F000-0x00007FFE12180000-memory.dmp
memory/2560-15-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-6-0x00000282B9E60000-0x00000282B9E82000-memory.dmp
memory/2560-16-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-13-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-19-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-20-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-21-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-22-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-23-0x00000282B73F0000-0x00000282B744C000-memory.dmp
memory/2560-24-0x00000282B7450000-0x00000282B7462000-memory.dmp
memory/2560-25-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-26-0x00007FFE11FF0000-0x00007FFE12994000-memory.dmp
memory/2560-28-0x00000282B7490000-0x00000282B74D2000-memory.dmp
memory/2560-29-0x00000282D2430000-0x00000282D2480000-memory.dmp