Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
03/07/2026, 10:16
General
- Target 476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae.exe
- Size 993KB
- Sample260703-mbazesfs81
- SHA256 476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae
Malware Config
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
true
-
startup_directory_name
pyUwyf
-
startup_env_name
appdata
-
startup_installation_name
pyUwyf.exe
-
startup_reg_name
pyUwyf
-
tor_pid
false
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae.exe"C:\Users\Admin\AppData\Local\Temp\476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae.exe"C:\Users\Admin\AppData\Local\Temp\476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\476cc1fe35e33d4d85763d170a06b654fa4c8994bc64b9ccaebe98c51abacbae.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3736-11-0x0000000000400000-0x000000000061D000-memory.dmp
memory/5748-0-0x0000000000400000-0x000000000061D000-memory.dmp
memory/5748-2-0x0000000001CF0000-0x0000000001CF4000-memory.dmp
memory/5748-4-0x0000000000400000-0x000000000061D000-memory.dmp
memory/6016-7-0x0000000000400000-0x0000000000446000-memory.dmp
memory/6016-9-0x0000000000400000-0x0000000000446000-memory.dmp
memory/6016-8-0x0000000000400000-0x0000000000446000-memory.dmp
memory/6016-10-0x0000000000400000-0x0000000000446000-memory.dmp
memory/6016-12-0x0000000073B72000-0x0000000073B73000-memory.dmp
memory/6016-13-0x0000000002CC0000-0x0000000002D14000-memory.dmp
memory/6016-14-0x0000000073B60000-0x000000007431C000-memory.dmp
memory/6016-15-0x0000000005910000-0x0000000005ECA000-memory.dmp
memory/6016-16-0x0000000002E60000-0x0000000002EB2000-memory.dmp
memory/6016-17-0x0000000073B60000-0x000000007431C000-memory.dmp
memory/6016-137-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-134-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-132-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-130-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-128-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-124-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-122-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-120-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-118-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-114-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-112-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-110-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-108-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-106-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-104-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-100-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-98-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-96-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-94-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-90-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-86-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-82-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-78-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-77-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-74-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-70-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-68-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-66-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-62-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-60-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-58-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-54-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-50-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-48-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-46-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-44-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-42-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-40-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-38-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-34-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-32-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-30-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-28-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-26-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-24-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-22-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-20-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-19-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-126-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-116-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-102-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-92-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-88-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-84-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-80-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-72-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-64-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-56-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-52-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-36-0x0000000002E60000-0x0000000002EAD000-memory.dmp
memory/6016-18-0x0000000073B60000-0x000000007431C000-memory.dmp
memory/6016-1049-0x00000000054E0000-0x0000000005546000-memory.dmp
memory/6016-1050-0x0000000073B60000-0x000000007431C000-memory.dmp
memory/6016-1051-0x0000000006450000-0x00000000064A0000-memory.dmp
memory/6016-1052-0x0000000006540000-0x00000000065D2000-memory.dmp
memory/6016-1053-0x00000000064A0000-0x00000000064AA000-memory.dmp
memory/6016-1054-0x0000000073B72000-0x0000000073B73000-memory.dmp
memory/6016-1055-0x0000000073B60000-0x000000007431C000-memory.dmp