Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 21:56
General
- Target 07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe
- Size 836KB
- Sample260712-1tebfsbt7s
- SHA256 07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e
Malware Config
Extracted
-
agenttesla
-
app_add_startup
false
-
delete_backspace
false
-
enable_clipboard_logger
false
-
enable_contacts
false
-
enable_cookies
false
-
enable_keylogger
false
-
enable_screen_logger
false
-
enable_torpanel
false
-
hide_file_startup
false
-
keylogger_interval
20
-
log_type
1
-
pc_state
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
public_ip_address_grab
false
-
public_user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
-
screen_interval
20
-
smtp_attach
false
-
smtp_ssl
true
-
startup_directory_name
gnxLZ
-
startup_env_name
appdata
-
startup_installation_name
gnxLZ.exe
-
startup_reg_name
gnxLZ
-
tor_pid
false
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe"C:\Users\Admin\AppData\Local\Temp\07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe"C:\Users\Admin\AppData\Local\Temp\07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe"C:\Users\Admin\AppData\Local\Temp\07d9ea3efb31c16c6f58dbbfa380f267719f9ef565c2852215f2911a9bfbc42e.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/2208-0-0x0000000074222000-0x0000000074223000-memory.dmp
memory/2208-1-0x0000000000E40000-0x0000000000F18000-memory.dmp
memory/2208-2-0x00000000060D0000-0x000000000668A000-memory.dmp
memory/2208-3-0x0000000005A20000-0x0000000005AB2000-memory.dmp
memory/2208-4-0x0000000005AF0000-0x0000000005AFA000-memory.dmp
memory/2208-5-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2208-6-0x0000000005D10000-0x0000000005D22000-memory.dmp
memory/2208-7-0x0000000074222000-0x0000000074223000-memory.dmp
memory/2208-8-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2208-9-0x00000000082E0000-0x0000000008388000-memory.dmp
memory/2208-10-0x000000000AA80000-0x000000000AB1C000-memory.dmp
memory/2208-827-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2736-60-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-108-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-12-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2736-16-0x00000000033A0000-0x00000000033F6000-memory.dmp
memory/2736-19-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2736-136-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-176-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2736-140-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-138-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-134-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-132-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-130-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-128-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-126-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-124-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-122-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-116-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-114-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-112-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-110-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-11-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2736-104-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-100-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-98-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-96-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-94-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-92-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-90-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-88-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-86-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-82-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-80-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-78-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-76-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-74-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-72-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-68-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-66-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-64-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-62-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-13-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2736-423-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2736-846-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2736-845-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2736-844-0x0000000006FC0000-0x0000000007010000-memory.dmp
memory/2736-18-0x0000000003440000-0x0000000003496000-memory.dmp
memory/2736-14-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2736-29-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-821-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2736-46-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-56-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-825-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/2736-70-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-84-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-102-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-820-0x0000000005AD0000-0x0000000005B36000-memory.dmp
memory/2736-58-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-54-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-52-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-106-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-118-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-120-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-21-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-22-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-24-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-50-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-48-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-44-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-42-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-40-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-38-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-26-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-36-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-30-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-34-0x0000000003440000-0x000000000348F000-memory.dmp
memory/2736-32-0x0000000003440000-0x000000000348F000-memory.dmp
memory/3964-841-0x00000000079E0000-0x0000000007A76000-memory.dmp
memory/3964-824-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/3964-832-0x00000000069E0000-0x0000000006A16000-memory.dmp
memory/3964-826-0x0000000005FA0000-0x00000000062FB000-memory.dmp
memory/3964-839-0x0000000007770000-0x000000000778A000-memory.dmp
memory/3964-836-0x00000000069C0000-0x00000000069E0000-memory.dmp
memory/3964-837-0x0000000007410000-0x00000000074B3000-memory.dmp
memory/3964-822-0x0000000005540000-0x0000000005562000-memory.dmp
memory/3964-840-0x00000000077E0000-0x00000000077EA000-memory.dmp
memory/3964-833-0x0000000070890000-0x00000000708DC000-memory.dmp
memory/3964-838-0x0000000007DB0000-0x000000000842C000-memory.dmp
memory/3964-823-0x00000000055E0000-0x0000000005646000-memory.dmp
memory/3964-830-0x0000000006440000-0x000000000645E000-memory.dmp
memory/3964-831-0x0000000006800000-0x000000000684C000-memory.dmp
memory/3964-657-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/3964-843-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/3964-20-0x0000000005770000-0x0000000005DBA000-memory.dmp
memory/3964-17-0x0000000002BC0000-0x0000000002BF6000-memory.dmp
memory/3964-15-0x0000000074222000-0x0000000074223000-memory.dmp