agenttesla | d2989c7149d41251cb115b49880da9c819d3823299ffcd187fba5b23a36e7f4f

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zahlungs-IBAN-Bestätigung 06-08-2026 pdf.vbs
Size 1.3MB
Sample260808-pm286afk9t
SHA256 d2989c7149d41251cb115b49880da9c819d3823299ffcd187fba5b23a36e7f4f
MD5 f796b8900312190fb1f4b929feb8e9fb
SHA1 435ecf2a8e10abdc32dee30ea2aed337da2eba79
SHA512 c62ac4acdf8ef06389992fa96db89ae47fb5be4e688c2fec540cc47d52eaf7c7753396e48de5fc14fa0710d8a29a7e3604ae10af7fc170ed820b535530b52226
SSDEEP 12288:va43QE4CtLpFECfhQz3Zvd+4MMPkjcnMRTAE4QvjiuAhxlhTdXQtK48yyCzIThp4:varZM4Pxl5dXQtsCaieqhhEJULZ7
TLSH
T18355A8ACE476BF1C2F92F35FC685E46615A1E6860B03FADAD47C54E600530B0ACF54AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.hhautoinvestment.co.tz
Port
21
Username
[email protected]
Password
[email protected]&

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2312	powershell.exe
3924	powershell.exe
3388	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3968	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5784	cmd.exe
4992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2312	powershell.exe
2312	powershell.exe
3924	powershell.exe
3924	powershell.exe
3388	powershell.exe
3388	powershell.exe
3388	powershell.exe
904	prevhost.exe
904	prevhost.exe
904	prevhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeDebugPrivilege	5204	whoami.exe
Token: SeIncreaseQuotaPrivilege	3388	powershell.exe
Token: SeSecurityPrivilege	3388	powershell.exe
Token: SeTakeOwnershipPrivilege	3388	powershell.exe
Token: SeLoadDriverPrivilege	3388	powershell.exe
Token: SeSystemProfilePrivilege	3388	powershell.exe
Token: SeSystemtimePrivilege	3388	powershell.exe
Token: SeProfSingleProcessPrivilege	3388	powershell.exe
Token: SeIncBasePriorityPrivilege	3388	powershell.exe
Token: SeCreatePagefilePrivilege	3388	powershell.exe
Token: SeBackupPrivilege	3388	powershell.exe
Token: SeRestorePrivilege	3388	powershell.exe
Token: SeShutdownPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeSystemEnvironmentPrivilege	3388	powershell.exe
Token: SeRemoteShutdownPrivilege	3388	powershell.exe
Token: SeUndockPrivilege	3388	powershell.exe
Token: SeManageVolumePrivilege	3388	powershell.exe
Token: 33	3388	powershell.exe
Token: 34	3388	powershell.exe
Token: 35	3388	powershell.exe
Token: 36	3388	powershell.exe
Token: SeIncreaseQuotaPrivilege	3388	powershell.exe
Token: SeSecurityPrivilege	3388	powershell.exe
Token: SeTakeOwnershipPrivilege	3388	powershell.exe
Token: SeLoadDriverPrivilege	3388	powershell.exe
Token: SeSystemProfilePrivilege	3388	powershell.exe
Token: SeSystemtimePrivilege	3388	powershell.exe
Token: SeProfSingleProcessPrivilege	3388	powershell.exe
Token: SeIncBasePriorityPrivilege	3388	powershell.exe
Token: SeCreatePagefilePrivilege	3388	powershell.exe
Token: SeBackupPrivilege	3388	powershell.exe
Token: SeRestorePrivilege	3388	powershell.exe
Token: SeShutdownPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeSystemEnvironmentPrivilege	3388	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 5784	3968	WScript.exe	89
PID 5784 wrote to memory of 2312	5784	cmd.exe	91
PID 2312 wrote to memory of 4992	2312	powershell.exe	92
PID 4992 wrote to memory of 3924	4992	cmd.exe	94
PID 4992 wrote to memory of 1636	4992	cmd.exe	95
PID 4992 wrote to memory of 3388	4992	cmd.exe	96
PID 3388 wrote to memory of 5204	3388	powershell.exe	97
PID 3388 wrote to memory of 904	3388	powershell.exe	100
PID 3388 wrote to memory of 904	3388	powershell.exe	100
PID 3388 wrote to memory of 904	3388	powershell.exe	100

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1636	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	prevhost.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zahlungs-IBAN-Bestätigung 06-08-2026 pdf.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\02E37388.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:UVOTSQXFCZ))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\02E37388.cmd" GJKMNDWKQ"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:HNSHTR))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
    - - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\fontcache_v\fontcache_v.dat"
        5⤵
        Views/modifies file attributes
        
        PID:1636
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:NIFRCLTNNGW))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3388
      - C:\Windows\SysWOW64\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /groups
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5204
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        outlook_office_path
        
        PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

02E37388.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\02E37388.cmd
Size 638KB
SHA256 cabce722725ac743178af89c125fde5d4871483e4352f0380a877f2847e786b8
MD5 5b6f595cb536d11582a700c865d34ec8
SHA1 4542d6dfbb50101790d4fd87b68130a7efb20d0d
SHA512 bf5dbd5a66350eaa38304b6593bf27f392fdddf0bbedd5b2a7e58934932cd6253772be83d0ae2d9d594b1ec2e2165b6e6565369dc96bf0ca6beea4945d97a66e
SSDEEP 12288:bIaTgWnFAt3NTTL/IEsEOnN/qyEXb+urAgAoj9RaZIPBsHEut:bI2FAt9D/XxOnQpXbv8IGwB+Eut
TLSH
T1CCD41260AF9ABA0A23FA411796416A9E1739DEC23B27E4DD319033C73B1D713E90B745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e14a7b28afff95b70ba849207619ff903c6ea821b8cf2c12b589579a7d7d3af
MD5 099f7306d2e129f2a3dd4a124f5e9f61
SHA1 d5f10a991ea12b52de9b43832ff344766835e8a1
SHA512 9914dea58ce264b1a34f795aa57129779222f50fd7f4c658a649e1cfc84042af732389bfff477919dc04b802c28ff404225883f52a43fce8da7c5b0ee550054c
TLSH
T108215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 dfff83f691483c1ca52fe48caab77cdaaf31c97d6e65f5a711d6490e1636760b
MD5 2d7e4109360b3679dceb84285bcab5dd
SHA1 3e78198a1d9140f2362de0ac54262ec098df6f68
SHA512 b002452fc048aca5659994657b884f2990a6a6d686ded0ae30924c7d04acc4f35d36b552b7bc75c19aee0fa7defd39ab92d8fce886901ac1d9b08cd85b49bdc5
SSDEEP 384:E1TBaGV1ivy4b0UGoovCVM2H42PntIAbk4caGtIWjq76oQwjN+mvsbhNn8/pdmvG:QTnfOr4UGooItFIAbkBaGt/a6oQ5wsbA
TLSH
T178829768127F7DC7D8D112B411D602E7FBE4E048DA7551A8FF2BDE2B1C90ABB4E61620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_yg5uz0oq.wme.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yg5uz0oq.wme.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/904-63-0x0000000005B00000-0x0000000005B0A000-memory.dmp

Download

memory/904-57-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/904-59-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/904-58-0x0000000002880000-0x00000000028C2000-memory.dmp

Download

memory/904-61-0x0000000005B40000-0x0000000005BD2000-memory.dmp

Download

memory/904-62-0x0000000005BE0000-0x0000000005C30000-memory.dmp

Download

memory/2312-8-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-15-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-14-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-12-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-11-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-10-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-9-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-7-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-6-0x00007FFEECD60000-0x00007FFEED704000-memory.dmp

Download

memory/2312-5-0x0000019DEB8D0000-0x0000019DEB8F2000-memory.dmp

Download

memory/2312-2-0x00007FFEECEEF000-0x00007FFEECEF0000-memory.dmp

Download

memory/3388-46-0x0000000007960000-0x0000000007984000-memory.dmp

Download

memory/3388-44-0x00000000077A0000-0x00000000077AA000-memory.dmp

Download

memory/3388-32-0x0000000005A80000-0x0000000005DDB000-memory.dmp

Download

memory/3388-48-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3388-54-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3388-34-0x0000000007270000-0x0000000007306000-memory.dmp

Download

memory/3388-35-0x0000000007310000-0x0000000007332000-memory.dmp

Download

memory/3388-36-0x0000000008080000-0x000000000863A000-memory.dmp

Download

memory/3388-37-0x00000000073C0000-0x00000000073F6000-memory.dmp

Download

memory/3388-38-0x0000000070B20000-0x0000000070B6C000-memory.dmp

Download

memory/3388-39-0x0000000070DE0000-0x000000007113B000-memory.dmp

Download

memory/3388-42-0x0000000007600000-0x0000000007620000-memory.dmp

Download

memory/3388-43-0x00000000076B0000-0x0000000007753000-memory.dmp

Download

memory/3388-55-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3388-45-0x0000000007930000-0x000000000795A000-memory.dmp

Download

memory/3388-56-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3388-47-0x0000000000B70000-0x0000000000B78000-memory.dmp

Download

memory/3388-53-0x0000000010000000-0x0000000010060000-memory.dmp

Download

memory/3924-25-0x0000000006710000-0x000000000672E000-memory.dmp

Download

memory/3924-28-0x0000000006CD0000-0x0000000006CEA000-memory.dmp

Download

memory/3924-26-0x0000000006790000-0x00000000067DC000-memory.dmp

Download

memory/3924-27-0x0000000007F60000-0x00000000085DC000-memory.dmp

Download

memory/3924-23-0x00000000062E0000-0x000000000663B000-memory.dmp

Download

memory/3924-19-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Download

memory/3924-20-0x0000000005B40000-0x0000000005BA6000-memory.dmp

Download

memory/3924-18-0x0000000005930000-0x0000000005952000-memory.dmp

Download

memory/3924-17-0x0000000005C90000-0x00000000062DA000-memory.dmp

Download

memory/3924-16-0x0000000003340000-0x0000000003376000-memory.dmp

Download