agenttesla | 57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3

Resubmissions

16/08/2026, 16:16

260816-tq1lysssft

07/08/2026, 19:22

260807-x3d59shf97

27/07/2026, 21:53

260727-1rpdmsdd9610

Analysis

max time kernel
149s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Size 1.1MB
Sample260727-1rpdmsdd96
SHA256 57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3
MD5 3655d9ae7e7c163a060151ddd2ffe16c
SHA1 808e5f026d93a25c3651c95b55f9ebda880bb796
SHA512 f6fb3a21056e63251704eef694246340f1cd9c58c1059fd1f68a0d4c4492c0dcee0e6ad357b12793ee4afb7ef1f6c50feb5d2a837d09437a1400bfd086e6c6a5
SSDEEP 12288:+vYeGGASYfVsFlEIU+0O2LFAJHm9YqIUUyRgVVpfcqPSTCesaJYM0JiogUbD8S3m:+2Opxv+FAAyqyZQBsaJYMoQU
TLSH
T1E03505B026D63A05E43A07F4BB49857C437B4D4A5829CB47CD95E8EB3DA3B97060CA73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.haliza.com.my
Port
21
Username
[email protected]
Password
JesusChrist007$

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4488	powershell.exe
4300	powershell.exe
980	powershell.exe
5024	powershell.exe
864	powershell.exe
2820	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	ewztPxkhtgH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	sgxIb.exe

Executes dropped EXE 7 IoCs

pid	Process
1624	ewztPxkhtgH.exe
4856	sgxIb.exe
2152	ewztPxkhtgH.exe
4944	sgxIb.exe
1628	sgxIb.exe
3524	sgxIb.exe
2800	sgxIb.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ewztPxkhtgH.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sgxIb.exe
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	ewztPxkhtgH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
41	api.ipify.org
42	api.ipify.org
16	api.ipify.org
17	api.ipify.org

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral11/memory/2340-6-0x0000000005280000-0x0000000005294000-memory.dmp	SmartAssembly
behavioral11/memory/1624-44-0x0000000005750000-0x0000000005764000-memory.dmp	SmartAssembly
behavioral11/memory/4856-77-0x0000000006E30000-0x0000000006E44000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 208	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	93
PID 1624 set thread context of 2152	1624	ewztPxkhtgH.exe	106
PID 4856 set thread context of 2800	4856	sgxIb.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewztPxkhtgH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewztPxkhtgH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgxIb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgxIb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4012	schtasks.exe
4068	schtasks.exe
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4488	powershell.exe
4300	powershell.exe
208	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
208	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
4488	powershell.exe
4300	powershell.exe
5024	powershell.exe
5024	powershell.exe
980	powershell.exe
980	powershell.exe
5024	powershell.exe
2152	ewztPxkhtgH.exe
2152	ewztPxkhtgH.exe
980	powershell.exe
864	powershell.exe
864	powershell.exe
2820	powershell.exe
2820	powershell.exe
4856	sgxIb.exe
4856	sgxIb.exe
4856	sgxIb.exe
4856	sgxIb.exe
4856	sgxIb.exe
4856	sgxIb.exe
864	powershell.exe
2800	sgxIb.exe
2800	sgxIb.exe
2800	sgxIb.exe
2820	powershell.exe
2152	ewztPxkhtgH.exe
2152	ewztPxkhtgH.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
2152	ewztPxkhtgH.exe
2800	sgxIb.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	208	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	2152	ewztPxkhtgH.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	4856	sgxIb.exe
Token: SeDebugPrivilege	2800	sgxIb.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
208	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
2152	ewztPxkhtgH.exe
2800	sgxIb.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4488	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	87
PID 2340 wrote to memory of 4300	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	89
PID 2340 wrote to memory of 4068	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	91
PID 2340 wrote to memory of 208	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	93
PID 2340 wrote to memory of 208	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	93
PID 2340 wrote to memory of 208	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	93
PID 2340 wrote to memory of 208	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	93
PID 2340 wrote to memory of 208	2340	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	93
PID 1624 wrote to memory of 980	1624	ewztPxkhtgH.exe	100
PID 1624 wrote to memory of 5024	1624	ewztPxkhtgH.exe	102
PID 1624 wrote to memory of 4596	1624	ewztPxkhtgH.exe	104
PID 1624 wrote to memory of 2152	1624	ewztPxkhtgH.exe	106
PID 1624 wrote to memory of 2152	1624	ewztPxkhtgH.exe	106
PID 1624 wrote to memory of 2152	1624	ewztPxkhtgH.exe	106
PID 1624 wrote to memory of 2152	1624	ewztPxkhtgH.exe	106
PID 1624 wrote to memory of 2152	1624	ewztPxkhtgH.exe	106
PID 4856 wrote to memory of 864	4856	sgxIb.exe	107
PID 4856 wrote to memory of 2820	4856	sgxIb.exe	109
PID 4856 wrote to memory of 4012	4856	sgxIb.exe	111
PID 4856 wrote to memory of 4944	4856	sgxIb.exe	113
PID 4856 wrote to memory of 1628	4856	sgxIb.exe	114
PID 4856 wrote to memory of 3524	4856	sgxIb.exe	115
PID 4856 wrote to memory of 2800	4856	sgxIb.exe	116
PID 4856 wrote to memory of 2800	4856	sgxIb.exe	116
PID 4856 wrote to memory of 2800	4856	sgxIb.exe	116
PID 4856 wrote to memory of 2800	4856	sgxIb.exe	116
PID 4856 wrote to memory of 2800	4856	sgxIb.exe	116

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sgxIb.exe

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ewztPxkhtgH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB9C6.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
  "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:208

C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ewztPxkhtgH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFCCA.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4596
- C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
  "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2152

C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ewztPxkhtgH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp69D.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4012
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  "C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe"
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  "C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  "C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe"
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  "C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ewztPxkhtgH.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ewztPxkhtgH.exe.log
Size 1KB
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
TLSH
T104219B303222B5D84D022F530C0869C513EF4759BB64EE2CB959231EDD2A457AB211E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 5c268a3471ec1c442899af5a508cd226f5e4315ddaf4a87fba1ea661be8e035f
MD5 9baf4d30351c6f49e1718ea603d7f6a6
SHA1 6132eaae25ae1c99714ee31cf796784a7a7092e7
SHA512 8b6cb49b373f7983d739b4d41e23e8dfb133bca6f5cce47d904b2caf4d8025676d2d55c6fef418f71930db6e8b019b5f9ba2ecec4012a5e30f541e160ca9420b
SSDEEP 384:csf+BO9i+OhDLKh3ffJQzVJk+o9o2ThK6seYLME/N03SoZufYSgcjEDkyQ0gdEt3:ZfGh4ff2zUjo2ThNgrWS5WCED/Ce3
TLSH
T1EB82E76E611F16C3C48613B8E11B055FE8F2DE8D531A13D87B1E9F3B8AAC69E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 98fc2c95d1d63308b84be68d1979651f15160b8ac6f3767da7e6dcd53dacd550
MD5 ba7594ee3cb62352088f0a62efd7e83a
SHA1 962ffc7500d538cd5bc598e1c8c9a0a836357eb5
SHA512 e501ef77efac1b9497a2056909ce9a4fa5ea054b3931bc2b50dab700e91ce05e96b91d9e4b6211ff67389e6c9f2ecc64307ee2421691c84712ef830e5d5368b8
SSDEEP 384:x6+BI91Scy9UAz5NjZwK6sm6anGZcifE6c51dqklllq+nUqkKkki0SO1:wRScyHFwLp5ifxc51dqwUqiki0H
TLSH
T1CF82175E622F1AD5E33623F4D43A87DBFAF099CBC38045DD2780593805DA76284EA4F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 984223230e477de408c9f3250ee99d07319ce6a156ffa1949b78645fd3b5b5ac
MD5 59562953431fd18cee42e21baccaaf0d
SHA1 d534d2dd8110942aad5dcb42d9471737e6937232
SHA512 e4006cf136cc1e3bab0fa3d18bfdd5dd218f29cf2ac1ade0b61f0cdbba321d32c06264e5ed1525d554a9a6805766cb8cef65b234183b3d3634ee4af26a549149
SSDEEP 384:3sf+BI91Nqk5WBizJklB6kysaBT7YRCnGZcifE6c5IdHllL+nUqVkki0SO1:cfRN34oeDysaBT7UC5ifxc5IdyUqiki6
TLSH
T1AE8209AD221F3AEBC0B623F4883647EBDE709DDF830007DD569A593B15DA37588950E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 854b5b18718a50503c76ae8834137e84169cde2052cc7df7843ffc153744371b
MD5 c51bfc39f368d4ff3d0a6b1f0a150c67
SHA1 9b289c4e84adbd538018d7762d0475f82fcf7381
SHA512 e7de1d6f322a99121ec0424b5afff12333cca531d16840a4bc4f21c070788cdfb2a6f8ef20a0dca9c1b0368132254733d61b604e88f5de8df3bfe69f5b5d9c17
SSDEEP 384:Msf+BI91PRyBbizJknfo9oTqfT3K6seY1anGZcifE6EhIdFlL+nUqVhi0SO1:pfRP02ewoOfT3Nn5ifxEhIdyUqri0H
TLSH
T15C82086D221F3A97C0B623F4942A47EBDEB09DCF834407DE278A193B05D977594A50F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_qxpqsgnn.1c5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qxpqsgnn.1c5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpB9C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB9C6.tmp
Size 1KB
SHA256 0d04864a0fa7bfbb548ae7ae20be84e4f89d916d1ad6c5f49df28c669c20b670
MD5 e3125f2919b9d08c7cf88f8e82f1648b
SHA1 31a3e9dfeee48debb860e8bfff786b2bd781b5e8
SHA512 cb8bd87589f8a650d5fa3f79ed9aa09699ce0916c411a0cdd245147ade90303158661451b357b17255565bb82dd015cfdc391020c84b9e5380088fb8441ec2fb
TLSH
T1CC311264D8F0FB5BB64201298341A6835FB587B345554078F8CC0E787F8AA862053A7B
MD5 SHA1 SHA512 TLSH

Submit Download

ewztPxkhtgH.exe

Path C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
Size 1.1MB
SHA256 57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3
MD5 3655d9ae7e7c163a060151ddd2ffe16c
SHA1 808e5f026d93a25c3651c95b55f9ebda880bb796
SHA512 f6fb3a21056e63251704eef694246340f1cd9c58c1059fd1f68a0d4c4492c0dcee0e6ad357b12793ee4afb7ef1f6c50feb5d2a837d09437a1400bfd086e6c6a5
SSDEEP 12288:+vYeGGASYfVsFlEIU+0O2LFAJHm9YqIUUyRgVVpfcqPSTCesaJYM0JiogUbD8S3m:+2Opxv+FAAyqyZQBsaJYMoQU
TLSH
T1E03505B026D63A05E43A07F4BB49857C437B4D4A5829CB47CD95E8EB3DA3B97060CA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-76-0x00000000067C0000-0x0000000006810000-memory.dmp

Download

memory/208-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/864-157-0x0000000007BA0000-0x0000000007C43000-memory.dmp

Download

memory/864-149-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/980-104-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/980-121-0x00000000075C0000-0x00000000075D1000-memory.dmp

Download

memory/980-112-0x0000000007280000-0x0000000007323000-memory.dmp

Download

memory/980-122-0x0000000007620000-0x0000000007634000-memory.dmp

Download

memory/1624-44-0x0000000005750000-0x0000000005764000-memory.dmp

Download

memory/2340-8-0x0000000006250000-0x00000000062D8000-memory.dmp

Download

memory/2340-7-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/2340-3-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/2340-4-0x0000000005070000-0x000000000507A000-memory.dmp

Download

memory/2340-6-0x0000000005280000-0x0000000005294000-memory.dmp

Download

memory/2340-5-0x00000000052A0000-0x000000000533C000-memory.dmp

Download

memory/2340-2-0x0000000004FB0000-0x0000000005042000-memory.dmp

Download

memory/2340-1-0x0000000005560000-0x0000000005B04000-memory.dmp

Download

memory/2340-0-0x00000000004A0000-0x00000000005B6000-memory.dmp

Download

memory/2820-158-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/2820-166-0x0000000007A90000-0x0000000007AA4000-memory.dmp

Download

memory/4300-73-0x00000000071B0000-0x00000000071B8000-memory.dmp

Download

memory/4300-56-0x0000000070520000-0x000000007056C000-memory.dmp

Download

memory/4300-20-0x0000000004AB0000-0x0000000004AD2000-memory.dmp

Download

memory/4300-64-0x0000000006E90000-0x0000000006EAA000-memory.dmp

Download

memory/4300-66-0x0000000006F10000-0x0000000006F1A000-memory.dmp

Download

memory/4300-17-0x0000000004600000-0x0000000004610000-memory.dmp

Download

memory/4300-18-0x0000000004C40000-0x0000000005268000-memory.dmp

Download

memory/4300-16-0x0000000004600000-0x0000000004610000-memory.dmp

Download

memory/4300-71-0x00000000070D0000-0x00000000070E4000-memory.dmp

Download

memory/4300-72-0x00000000071D0000-0x00000000071EA000-memory.dmp

Download

memory/4488-54-0x0000000006DE0000-0x0000000006DFE000-memory.dmp

Download

memory/4488-45-0x0000000006E00000-0x0000000006E32000-memory.dmp

Download

memory/4488-13-0x00000000052C0000-0x00000000052F6000-memory.dmp

Download

memory/4488-68-0x0000000007D70000-0x0000000007D81000-memory.dmp

Download

memory/4488-14-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4488-67-0x0000000007DF0000-0x0000000007E86000-memory.dmp

Download

memory/4488-65-0x00000000081B0000-0x000000000882A000-memory.dmp

Download

memory/4488-15-0x0000000005380000-0x0000000005390000-memory.dmp

Download

memory/4488-55-0x0000000007820000-0x00000000078C3000-memory.dmp

Download

memory/4488-70-0x0000000007DA0000-0x0000000007DAE000-memory.dmp

Download

memory/4488-22-0x00000000061D0000-0x0000000006236000-memory.dmp

Download

memory/4488-46-0x0000000070520000-0x000000007056C000-memory.dmp

Download

memory/4488-41-0x0000000006870000-0x00000000068BC000-memory.dmp

Download

memory/4488-40-0x0000000006840000-0x000000000685E000-memory.dmp

Download

memory/4488-25-0x0000000006240000-0x0000000006594000-memory.dmp

Download

memory/4488-21-0x0000000006160000-0x00000000061C6000-memory.dmp

Download

memory/4856-77-0x0000000006E30000-0x0000000006E44000-memory.dmp

Download

memory/5024-113-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/5024-103-0x0000000006120000-0x000000000616C000-memory.dmp

Download

memory/5024-90-0x0000000005B20000-0x0000000005E74000-memory.dmp

Download