agenttesla | 57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3

Resubmissions

16/08/2026, 16:16

260816-tq1lysssft

07/08/2026, 19:22

260807-x3d59shf97

27/07/2026, 21:53

260727-1rpdmsdd9610

Analysis

user interaction
yes
max time kernel
149s
max time network
180s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Size 1.1MB
Sample260727-1rpdmsdd96
SHA256 57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3
MD5 3655d9ae7e7c163a060151ddd2ffe16c
SHA1 808e5f026d93a25c3651c95b55f9ebda880bb796
SHA512 f6fb3a21056e63251704eef694246340f1cd9c58c1059fd1f68a0d4c4492c0dcee0e6ad357b12793ee4afb7ef1f6c50feb5d2a837d09437a1400bfd086e6c6a5
SSDEEP 12288:+vYeGGASYfVsFlEIU+0O2LFAJHm9YqIUUyRgVVpfcqPSTCesaJYM0JiogUbD8S3m:+2Opxv+FAAyqyZQBsaJYMoQU
TLSH
T1E03505B026D63A05E43A07F4BB49857C437B4D4A5829CB47CD95E8EB3DA3B97060CA73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.haliza.com.my
Port
21
Username
[email protected]
Password
JesusChrist007$

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4572	powershell.exe
1712	powershell.exe
1128	powershell.exe
1492	powershell.exe
3036	powershell.exe
264	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
2940	ewztPxkhtgH.exe
2816	sgxIb.exe
6004	ewztPxkhtgH.exe
5920	ewztPxkhtgH.exe
2848	sgxIb.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sgxIb.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ewztPxkhtgH.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgxIb = "C:\\Users\\Admin\\AppData\\Roaming\\sgxIb\\sgxIb.exe"	ewztPxkhtgH.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org
3	api.ipify.org
4	api.ipify.org

SmartAssembly .NET packer 3 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral12/memory/4188-7-0x0000000005CC0000-0x0000000005CD4000-memory.dmp	SmartAssembly
behavioral12/memory/2940-47-0x0000000005BA0000-0x0000000005BB4000-memory.dmp	SmartAssembly
behavioral12/memory/2816-54-0x0000000004F40000-0x0000000004F54000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4188 set thread context of 4584	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	95
PID 2940 set thread context of 5920	2940	ewztPxkhtgH.exe	110
PID 2816 set thread context of 2848	2816	sgxIb.exe	117

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewztPxkhtgH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgxIb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewztPxkhtgH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sgxIb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5784	schtasks.exe
4840	schtasks.exe
5484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3036	powershell.exe
3036	powershell.exe
264	powershell.exe
264	powershell.exe
3036	powershell.exe
4584	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
4584	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
4584	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
264	powershell.exe
4572	powershell.exe
4572	powershell.exe
1712	powershell.exe
1712	powershell.exe
2940	ewztPxkhtgH.exe
2940	ewztPxkhtgH.exe
5920	ewztPxkhtgH.exe
5920	ewztPxkhtgH.exe
5920	ewztPxkhtgH.exe
4572	powershell.exe
1712	powershell.exe
1128	powershell.exe
1128	powershell.exe
1492	powershell.exe
1492	powershell.exe
5920	ewztPxkhtgH.exe
2848	sgxIb.exe
2848	sgxIb.exe
2848	sgxIb.exe
1128	powershell.exe
1492	powershell.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
5920	ewztPxkhtgH.exe
2848	sgxIb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	264	powershell.exe
Token: SeDebugPrivilege	4584	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
Token: SeIncreaseQuotaPrivilege	3036	powershell.exe
Token: SeSecurityPrivilege	3036	powershell.exe
Token: SeTakeOwnershipPrivilege	3036	powershell.exe
Token: SeLoadDriverPrivilege	3036	powershell.exe
Token: SeSystemProfilePrivilege	3036	powershell.exe
Token: SeSystemtimePrivilege	3036	powershell.exe
Token: SeProfSingleProcessPrivilege	3036	powershell.exe
Token: SeIncBasePriorityPrivilege	3036	powershell.exe
Token: SeCreatePagefilePrivilege	3036	powershell.exe
Token: SeBackupPrivilege	3036	powershell.exe
Token: SeRestorePrivilege	3036	powershell.exe
Token: SeShutdownPrivilege	3036	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe
Token: SeSystemEnvironmentPrivilege	3036	powershell.exe
Token: SeRemoteShutdownPrivilege	3036	powershell.exe
Token: SeUndockPrivilege	3036	powershell.exe
Token: SeManageVolumePrivilege	3036	powershell.exe
Token: 33	3036	powershell.exe
Token: 34	3036	powershell.exe
Token: 35	3036	powershell.exe
Token: 36	3036	powershell.exe
Token: SeIncreaseQuotaPrivilege	264	powershell.exe
Token: SeSecurityPrivilege	264	powershell.exe
Token: SeTakeOwnershipPrivilege	264	powershell.exe
Token: SeLoadDriverPrivilege	264	powershell.exe
Token: SeSystemProfilePrivilege	264	powershell.exe
Token: SeSystemtimePrivilege	264	powershell.exe
Token: SeProfSingleProcessPrivilege	264	powershell.exe
Token: SeIncBasePriorityPrivilege	264	powershell.exe
Token: SeCreatePagefilePrivilege	264	powershell.exe
Token: SeBackupPrivilege	264	powershell.exe
Token: SeRestorePrivilege	264	powershell.exe
Token: SeShutdownPrivilege	264	powershell.exe
Token: SeDebugPrivilege	264	powershell.exe
Token: SeSystemEnvironmentPrivilege	264	powershell.exe
Token: SeRemoteShutdownPrivilege	264	powershell.exe
Token: SeUndockPrivilege	264	powershell.exe
Token: SeManageVolumePrivilege	264	powershell.exe
Token: 33	264	powershell.exe
Token: 34	264	powershell.exe
Token: 35	264	powershell.exe
Token: 36	264	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	2940	ewztPxkhtgH.exe
Token: SeDebugPrivilege	5920	ewztPxkhtgH.exe
Token: SeIncreaseQuotaPrivilege	1712	powershell.exe
Token: SeSecurityPrivilege	1712	powershell.exe
Token: SeTakeOwnershipPrivilege	1712	powershell.exe
Token: SeLoadDriverPrivilege	1712	powershell.exe
Token: SeSystemProfilePrivilege	1712	powershell.exe
Token: SeSystemtimePrivilege	1712	powershell.exe
Token: SeProfSingleProcessPrivilege	1712	powershell.exe
Token: SeIncBasePriorityPrivilege	1712	powershell.exe
Token: SeCreatePagefilePrivilege	1712	powershell.exe
Token: SeBackupPrivilege	1712	powershell.exe
Token: SeRestorePrivilege	1712	powershell.exe
Token: SeShutdownPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeSystemEnvironmentPrivilege	1712	powershell.exe
Token: SeRemoteShutdownPrivilege	1712	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4584	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
5920	ewztPxkhtgH.exe
2848	sgxIb.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3036	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	89
PID 4188 wrote to memory of 264	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	91
PID 4188 wrote to memory of 5784	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	93
PID 4188 wrote to memory of 4584	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	95
PID 4188 wrote to memory of 4584	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	95
PID 4188 wrote to memory of 4584	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	95
PID 4188 wrote to memory of 4584	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	95
PID 4188 wrote to memory of 4584	4188	57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe	95
PID 2940 wrote to memory of 4572	2940	ewztPxkhtgH.exe	103
PID 2940 wrote to memory of 1712	2940	ewztPxkhtgH.exe	105
PID 2940 wrote to memory of 4840	2940	ewztPxkhtgH.exe	107
PID 2940 wrote to memory of 6004	2940	ewztPxkhtgH.exe	109
PID 2940 wrote to memory of 5920	2940	ewztPxkhtgH.exe	110
PID 2940 wrote to memory of 5920	2940	ewztPxkhtgH.exe	110
PID 2940 wrote to memory of 5920	2940	ewztPxkhtgH.exe	110
PID 2940 wrote to memory of 5920	2940	ewztPxkhtgH.exe	110
PID 2940 wrote to memory of 5920	2940	ewztPxkhtgH.exe	110
PID 2816 wrote to memory of 1128	2816	sgxIb.exe	111
PID 2816 wrote to memory of 1492	2816	sgxIb.exe	113
PID 2816 wrote to memory of 5484	2816	sgxIb.exe	115
PID 2816 wrote to memory of 2848	2816	sgxIb.exe	117
PID 2816 wrote to memory of 2848	2816	sgxIb.exe	117
PID 2816 wrote to memory of 2848	2816	sgxIb.exe	117
PID 2816 wrote to memory of 2848	2816	sgxIb.exe	117
PID 2816 wrote to memory of 2848	2816	sgxIb.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sgxIb.exe

C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
"C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ewztPxkhtgH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF66C.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5784
- C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
  "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4584

C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ewztPxkhtgH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp47F7.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4840
- C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
  "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Executes dropped EXE
  PID:6004
- C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
  "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5920

C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ewztPxkhtgH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp52B5.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5484
- C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe
  "C:\Users\Admin\AppData\Roaming\sgxIb\sgxIb.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3e0bc05229c6330e026dc0414514f3ae58e8d54543ccfb18f6129bd4cad2ca54
MD5 995e4c9e320ce023d70d2149b4de5def
SHA1 57ce053fbf17984737e97e3c43283d48508ec01b
SHA512 fd657914241da4c2021eb7def62e1b2aaecf9ff9289ec28b1772ead5972f36f427c1c44af09930fedce619fc39e76bae6e3b7eec653c09a4fff010e01fdb1074
SSDEEP 384:h1eBaoT1iBGSGW14bljgVh80CV+geLrrpPnNIAXr4B+lWoCtzKwUvYbhNaPIlRtS:7exZ6GJWihMVOZ+p1lIAXrq+yVrbhNat
TLSH
T12BA2C478213F6DC7D8D212B410D20AF7FBE0E489DAF61194BF1BDA2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 ed2da8e0155ba853a534d266f5b70ce82da2cc5f17391ec947ad6bb56cabd9de
MD5 de326d206f0a8a7a695ba1748e73c120
SHA1 b70bc612a3293832b748e600a295f5df6b01de2f
SHA512 fe74910d13692351c65f0e2364cf9c3101351d2ea87f293a5dd8a42a2984048b9ea238c56a7832063067ca34f4579e78cb9c1878ad2561bbefced757dc6d20ac
SSDEEP 384:Utt1eBaoT1iBGLJyD9em/+PxMeCar2znGMIACOwxmMEoaqB3KFpJv27hNIeU5htZ:UhexZ6GLJE91/+PT6CMIAXGBEoaM6F+e
TLSH
T16CA2E71D66AF99CBC491626910824343FBF8D198A7F252DBEF0FC92F2C4197D6E401E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 4fdb61d7dce3d09b4da45da82fcda75ed7ed5e5c755e536f8155f31fa26f2518
MD5 f211144fc5876671f100d5b1ef371746
SHA1 d91a41db0eeaa4425b74172b0fc864a805427566
SHA512 60c7e5045f4215848712cd8b97fd7ddcba764db680a4759b93f2967924dbc2603e68e36b9d4203b3c7e90d279c1363e82d3d376192f5c4e04b98edf46661e895
SSDEEP 384:nSEboT1iBGLlyxM26SdR+FQAdhR2PsiUDzdChIACOwxGFoaqB3KFp1v27hN/U5ho:10Z6GLl+MFSL+CmSpUFChIAXGWoaM6Fs
TLSH
T194A2F71C26AF89CBD95161B810824746F7F8E198E6E252DBFF0BC92F2C4167D6E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_stt3hxbt.ebd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_stt3hxbt.ebd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpF66C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF66C.tmp
Size 1KB
SHA256 20acaa0d1fc4c80e1c0d63a519677cb326cbc4eb145126f8a59f7b2a334e3261
MD5 199f838e99f2e4e5611dd8eeeed3c7ef
SHA1 b48e4f0f2b7ec3d872de943fc4d53b54bb721b0f
SHA512 aae89ae03aceb62106a2f711594c3807ad2784d4b38afdcd1addb1a9b28be28b971ad0a08b10b223c6fcc7789687ff9ad34e5e361730509e7a34180bb23577f2
TLSH
T11C311064D8F0FB5BB5530129835166835F758BB745620079F8CC0AB87F8A686205363B
MD5 SHA1 SHA512 TLSH

Submit Download

ewztPxkhtgH.exe

Path C:\Users\Admin\AppData\Roaming\ewztPxkhtgH.exe
Size 1.1MB
SHA256 57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3
MD5 3655d9ae7e7c163a060151ddd2ffe16c
SHA1 808e5f026d93a25c3651c95b55f9ebda880bb796
SHA512 f6fb3a21056e63251704eef694246340f1cd9c58c1059fd1f68a0d4c4492c0dcee0e6ad357b12793ee4afb7ef1f6c50feb5d2a837d09437a1400bfd086e6c6a5
SSDEEP 12288:+vYeGGASYfVsFlEIU+0O2LFAJHm9YqIUUyRgVVpfcqPSTCesaJYM0JiogUbD8S3m:+2Opxv+FAAyqyZQBsaJYMoQU
TLSH
T1E03505B026D63A05E43A07F4BB49857C437B4D4A5829CB47CD95E8EB3DA3B97060CA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-53-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/264-18-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/264-43-0x000000006FF80000-0x000000006FFCC000-memory.dmp

Download

memory/264-19-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/264-17-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/1128-82-0x0000000075090000-0x00000000750DC000-memory.dmp

Download

memory/1492-85-0x0000000075090000-0x00000000750DC000-memory.dmp

Download

memory/1712-67-0x0000000075090000-0x00000000750DC000-memory.dmp

Download

memory/1712-70-0x0000000007B70000-0x0000000007C13000-memory.dmp

Download

memory/2816-54-0x0000000004F40000-0x0000000004F54000-memory.dmp

Download

memory/2940-47-0x0000000005BA0000-0x0000000005BB4000-memory.dmp

Download

memory/3036-31-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

Download

memory/3036-14-0x0000000004CF0000-0x000000000533A000-memory.dmp

Download

memory/3036-20-0x0000000004C10000-0x0000000004C32000-memory.dmp

Download

memory/3036-21-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/3036-22-0x0000000005560000-0x00000000055C6000-memory.dmp

Download

memory/3036-16-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/3036-25-0x00000000057D0000-0x0000000005B2B000-memory.dmp

Download

memory/3036-50-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/3036-30-0x0000000005650000-0x000000000566E000-memory.dmp

Download

memory/3036-12-0x0000000000E40000-0x0000000000E76000-memory.dmp

Download

memory/3036-46-0x00000000070B0000-0x0000000007146000-memory.dmp

Download

memory/3036-15-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/3036-35-0x000000006FF80000-0x000000006FFCC000-memory.dmp

Download

memory/3036-38-0x00000000060B0000-0x00000000060D0000-memory.dmp

Download

memory/3036-13-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/3036-39-0x0000000006AF0000-0x0000000006B93000-memory.dmp

Download

memory/3036-34-0x0000000006A80000-0x0000000006AB6000-memory.dmp

Download

memory/3036-41-0x0000000006E40000-0x0000000006E5A000-memory.dmp

Download

memory/3036-40-0x0000000007480000-0x0000000007AFC000-memory.dmp

Download

memory/3036-42-0x0000000006EB0000-0x0000000006EBA000-memory.dmp

Download

memory/4188-0-0x0000000074812000-0x0000000074813000-memory.dmp

Download

memory/4188-4-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/4188-10-0x0000000007400000-0x0000000007488000-memory.dmp

Download

memory/4188-1-0x0000000000CE0000-0x0000000000DF6000-memory.dmp

Download

memory/4188-9-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/4188-8-0x0000000074812000-0x0000000074813000-memory.dmp

Download

memory/4188-7-0x0000000005CC0000-0x0000000005CD4000-memory.dmp

Download

memory/4188-2-0x0000000005D10000-0x00000000062CA000-memory.dmp

Download

memory/4188-3-0x00000000057F0000-0x0000000005882000-memory.dmp

Download

memory/4188-6-0x0000000005950000-0x00000000059EC000-memory.dmp

Download

memory/4188-32-0x0000000074800000-0x0000000074FBC000-memory.dmp

Download

memory/4188-5-0x00000000057E0000-0x00000000057EA000-memory.dmp

Download

memory/4572-71-0x0000000075090000-0x00000000750DC000-memory.dmp

Download

memory/4572-66-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/4584-55-0x0000000006940000-0x0000000006990000-memory.dmp

Download

memory/4584-29-0x0000000000400000-0x0000000000442000-memory.dmp

Download