Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 15:41
General
- Target 30fc332152721b4e56182d35541f656ea8f9b2b281dce56bbd867c05d9ac5a70.exe
- Size 1.1MB
- Sample260703-s4269sb16w
- SHA256 30fc332152721b4e56182d35541f656ea8f9b2b281dce56bbd867c05d9ac5a70
Malware Config
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
true
-
startup_directory_name
GLOZVJ
-
startup_env_name
appdata
-
startup_installation_name
GLOZVJ.exe
-
startup_reg_name
GLOZVJ
-
tor_pid
false
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\30fc332152721b4e56182d35541f656ea8f9b2b281dce56bbd867c05d9ac5a70.exe"C:\Users\Admin\AppData\Local\Temp\30fc332152721b4e56182d35541f656ea8f9b2b281dce56bbd867c05d9ac5a70.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\troopwise\pluff.exe"C:\Users\Admin\AppData\Local\Temp\30fc332152721b4e56182d35541f656ea8f9b2b281dce56bbd867c05d9ac5a70.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\30fc332152721b4e56182d35541f656ea8f9b2b281dce56bbd867c05d9ac5a70.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\troopwise\pluff.exe"C:\Users\Admin\AppData\Local\troopwise\pluff.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\troopwise\pluff.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\troopwise\pluff.exe"C:\Users\Admin\AppData\Local\troopwise\pluff.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\troopwise\pluff.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Zama
Zama
aut2292.tmp
aut22B2.tmp
finitism
pluff.exe
memory/3984-9-0x0000000002620000-0x0000000002624000-memory.dmp
memory/5580-123-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-121-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-53-0x0000000003000000-0x0000000003054000-memory.dmp
memory/5580-54-0x0000000005B30000-0x00000000060EA000-memory.dmp
memory/5580-55-0x00000000054E0000-0x0000000005532000-memory.dmp
memory/5580-59-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-57-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-56-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-71-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-177-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-175-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-171-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-170-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-167-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-165-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-163-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-159-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-157-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-155-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-151-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-149-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-147-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-145-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-143-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-141-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-139-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-135-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-133-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-131-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-129-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-125-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-51-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5580-113-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-117-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-52-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5580-115-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-81-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-109-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-107-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-103-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-101-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-99-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-97-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-95-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-93-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-91-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-89-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-85-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-83-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-111-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-79-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-75-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-69-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-67-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-65-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-63-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-61-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-173-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-161-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-153-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-137-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-127-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-119-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-105-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-87-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-77-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-73-0x00000000054E0000-0x000000000552D000-memory.dmp
memory/5580-1086-0x00000000056E0000-0x0000000005746000-memory.dmp
memory/5580-1087-0x00000000065F0000-0x0000000006640000-memory.dmp
memory/5580-1088-0x00000000066E0000-0x0000000006772000-memory.dmp
memory/5580-1089-0x0000000006640000-0x000000000664A000-memory.dmp