agenttesla | a74a948afc694949bf99f9bee9215cc759c082cded0ab1b8f6be345630bfd81e

Analysis

max time kernel
150s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_a74a948afc694949bf99f9bee9215cc759c082cded0ab1b8f6be345630bfd81e.js
Size 1.4MB
Sample260711-jay33sdy3k
SHA256 a74a948afc694949bf99f9bee9215cc759c082cded0ab1b8f6be345630bfd81e
MD5 35215786145f32823d1b4026aaf0e441
SHA1 9cc338e4d9b0797bf9cd21fb664e9467dbad9027
SHA512 91d79bfe02c54fdd1bdcf944acc0ae68224768f75c59d71e46896c7ac12a9f8cee7e6af0b30c435a1b33ab3201af64f0358645bae15d4dac5deab29a21b1f389
SSDEEP 24576:jAfEbCu1YAlYdqxbumWFIWxCBDQDqgt0JSEB6bWT4BIohLqMQhCBdt6:k5lbPBxPDn7+okX
TLSH
T1D365F1105BC46FAA8AAC1618D0BF2A5DF3F10AC5516778CAFF23BD49DFA670042271B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
server275.web-hosting.com
Port
587
Username
[email protected]
Password
]TX([%50.9r(l!K3
Email to
[email protected]

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4496	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4496 set thread context of 2104	4496	powershell.exe	93

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2756	taskkill.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
2104	aspnet_compiler.exe
2104	aspnet_compiler.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	2104	aspnet_compiler.exe
Token: SeDebugPrivilege	2756	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4496	2192	wscript.exe	86
PID 4496 wrote to memory of 1720	4496	powershell.exe	88
PID 4496 wrote to memory of 420	4496	powershell.exe	89
PID 4496 wrote to memory of 4724	4496	powershell.exe	90
PID 4496 wrote to memory of 4732	4496	powershell.exe	91
PID 4496 wrote to memory of 2900	4496	powershell.exe	92
PID 4496 wrote to memory of 2104	4496	powershell.exe	93
PID 4496 wrote to memory of 2104	4496	powershell.exe	93
PID 4496 wrote to memory of 2104	4496	powershell.exe	93
PID 4496 wrote to memory of 2104	4496	powershell.exe	93
PID 4496 wrote to memory of 2104	4496	powershell.exe	93
PID 2192 wrote to memory of 2756	2192	wscript.exe	96

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_a74a948afc694949bf99f9bee9215cc759c082cded0ab1b8f6be345630bfd81e.js
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\script_TlmA43eHqNKb_1783754918863.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4724
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4732
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    PID:2104
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

script_TlmA43eHqNKb_1783754918863.ps1

Path C:\Temp\script_TlmA43eHqNKb_1783754918863.ps1
Size 1.0MB
SHA256 13c0d22712354dde4a3508de8634440a5ebc1a8524ae52683aa8b573c340eeb7
MD5 01652fd92c511da4c06348c367d88593
SHA1 406187cddf16adae40eaf45485b5bec7c5d5667a
SHA512 9a275e6cf3f4a906ed451272b0765e6d19017dd647caf98eda564db53474e869eeac2ea066da772c36f91afbc673dfc9ba119147b196f8369fbf5a65ec20b2a7
SSDEEP 24576:jmw7B9oy+VHNRJwftyxctyHLICDT+QWphw5:LnMRdhH88Trn
TLSH
T130352329AB5C3FCE060150BEF896F889B09E11C706C7135797AC865427F69FAEB13C21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-23-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/2104-32-0x0000000074842000-0x0000000074843000-memory.dmp

Download

memory/2104-31-0x0000000006130000-0x000000000613A000-memory.dmp

Download

memory/2104-30-0x00000000061B0000-0x0000000006242000-memory.dmp

Download

memory/2104-29-0x0000000005A00000-0x0000000005A50000-memory.dmp

Download

memory/2104-26-0x0000000005300000-0x0000000005366000-memory.dmp

Download

memory/2104-25-0x0000000005A50000-0x000000000600A000-memory.dmp

Download

memory/2104-24-0x0000000074842000-0x0000000074843000-memory.dmp

Download

memory/2192-34-0x000001BEC9D60000-0x000001BEC9DDC000-memory.dmp

Download

memory/4496-10-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-11-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-15-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-16-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-17-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-18-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-19-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-20-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-21-0x0000023EB14E0000-0x0000023EB14F8000-memory.dmp

Download

memory/4496-13-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-12-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-14-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-1-0x00007FFA30E0F000-0x00007FFA30E10000-memory.dmp

Download

memory/4496-27-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-28-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-9-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-7-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-6-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-5-0x0000023EB1470000-0x0000023EB1492000-memory.dmp

Download

memory/4496-33-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download

memory/4496-4-0x00007FFA30C80000-0x00007FFA31624000-memory.dmp

Download