Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 10:16
General
- Target Quotation_Requirement.js
- Size 1013KB
- Sample260807-ma925awsf1
- SHA256 e177832273e9347afe9af00a28c4c53a092bb8e86f34b452b363018ac9500969
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.outlook-office365.com
-
Port
587
-
Username
-
Password
Payday2026
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Indirect Command Execution 1 TTPs 1 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Quotation_Requirement.js1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\forfiles.exe"C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m winver.exe /c "cmd /v:on /d /c echo !VH9HiB0TTyZyN4!|powershell.exe -W H -noP -NonI -"2⤵
- Indirect Command Execution
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe/v:on /d /c echo !VH9HiB0TTyZyN4!|powershell.exe -W H -noP -NonI -3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo $fHuYkt3=[powershell]::Create();[void]$fHuYkt3.AddScript([Environment]::GetEnvironmentVariable('L8esPqos8Lk4q4','Process'));$fHuYkt3.Invoke()"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -W H -noP -NonI -4⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4280-0-0x00007FFD36F6F000-0x00007FFD36F70000-memory.dmp
memory/4280-4-0x000001D55ED40000-0x000001D55ED62000-memory.dmp
memory/4280-5-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-3-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-6-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-7-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-8-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-9-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-10-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-11-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-12-0x000001D576DE0000-0x000001D576E30000-memory.dmp
memory/4280-15-0x000001D55ED70000-0x000001D55ED82000-memory.dmp
memory/4280-16-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-17-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-18-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-14-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-13-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-19-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp
memory/4280-20-0x000001D576E80000-0x000001D576EC0000-memory.dmp
memory/4280-21-0x000001D577D70000-0x000001D577DC0000-memory.dmp
memory/4280-22-0x00007FFD36DE0000-0x00007FFD37784000-memory.dmp