Analysis
- max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 12:38
General
- Target SVR26-616 - PDA - MARLIN DUA - TLP.exe
- Size 1.0MB
- Sample260730-pt4essssbw
- SHA256 907dd5d4c793cf6774a8f6638574b35ba6e6c9b10db51434eb5f60e4cee237df
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.allportcargoservice.com
-
Port
587
-
Username
-
Password
O!nPnH,#{Aqm
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SVR26-616 - PDA - MARLIN DUA - TLP.exe"C:\Users\Admin\AppData\Local\Temp\SVR26-616 - PDA - MARLIN DUA - TLP.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SVR26-616 - PDA - MARLIN DUA - TLP.exe"C:\Users\Admin\AppData\Local\Temp\SVR26-616 - PDA - MARLIN DUA - TLP.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\r1uc0pqaho2.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HyhfTFJckIgHX.exe"C:\Users\Admin\AppData\Roaming\HyhfTFJckIgHX.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HyhfTFJckIgHX.exe"C:\Users\Admin\AppData\Roaming\HyhfTFJckIgHX.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
r1uc0pqaho2.ps1
HyhfTFJckIgHX.exe
memory/4388-30-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-22-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-38-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-35-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-34-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-33-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-32-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-31-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-21-0x0000023232DF0000-0x0000023232E12000-memory.dmp
memory/4388-29-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-28-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-27-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-25-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-24-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-17-0x00007FFDF023F000-0x00007FFDF0240000-memory.dmp
memory/4388-18-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4388-23-0x00007FFDF00B0000-0x00007FFDF0A54000-memory.dmp
memory/4856-0-0x0000000074322000-0x0000000074323000-memory.dmp
memory/4856-5-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/4856-16-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/4856-4-0x0000000005880000-0x000000000588A000-memory.dmp
memory/4856-2-0x0000000005F70000-0x000000000652A000-memory.dmp
memory/4856-1-0x0000000000D90000-0x0000000000E98000-memory.dmp
memory/4856-3-0x0000000005890000-0x0000000005922000-memory.dmp
memory/4856-6-0x0000000005B10000-0x0000000005B2C000-memory.dmp
memory/4856-10-0x0000000008230000-0x0000000008310000-memory.dmp
memory/4856-9-0x0000000008170000-0x000000000820C000-memory.dmp
memory/4856-8-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/4856-7-0x0000000074322000-0x0000000074323000-memory.dmp
memory/5776-12-0x0000000000400000-0x0000000000440000-memory.dmp
memory/5776-13-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/5776-15-0x0000000074310000-0x0000000074ACC000-memory.dmp
memory/5776-14-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/5776-39-0x0000000006700000-0x0000000006750000-memory.dmp
memory/5776-40-0x0000000074310000-0x0000000074ACC000-memory.dmp