Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 12:28
General
- Target Zahlungs-IBAN-Bestätigung 06-08-2026 pdf.vbs
- Size 1.3MB
- Sample260808-pnfrjsxala
- SHA256 d2989c7149d41251cb115b49880da9c819d3823299ffcd187fba5b23a36e7f4f
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.hhautoinvestment.co.tz
-
Port
21
-
Username
-
Password
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Zahlungs-IBAN-Bestätigung 06-08-2026 pdf.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\02E41718.cmd"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:UVOTSQXFCZ))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\02E41718.cmd" GJKMNDWKQ"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:HNSHTR))"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\fontcache_v\fontcache_v.dat"5⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:NIFRCLTNNGW))"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\whoami.exe"C:\Windows\system32\whoami.exe" /groups6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\prevhost.exe"C:\Windows\SysWOW64\prevhost.exe"6⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
02E41718.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2pj0hdyz.n1l.ps1
memory/1252-11-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-8-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-9-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-10-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-4-0x0000022CA91F0000-0x0000022CA9212000-memory.dmp
memory/1252-12-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-13-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-14-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-16-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-17-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-5-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-3-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/1252-2-0x00007FFC242BF000-0x00007FFC242C0000-memory.dmp
memory/5104-30-0x00000000061E0000-0x00000000061FA000-memory.dmp
memory/5104-18-0x0000000004880000-0x00000000048B6000-memory.dmp
memory/5104-23-0x00000000056F0000-0x0000000005A4B000-memory.dmp
memory/5104-22-0x0000000005640000-0x00000000056A6000-memory.dmp
memory/5104-27-0x0000000005C30000-0x0000000005C4E000-memory.dmp
memory/5104-28-0x0000000005C70000-0x0000000005CBC000-memory.dmp
memory/5104-20-0x0000000004E60000-0x0000000004E82000-memory.dmp
memory/5104-29-0x0000000007480000-0x0000000007AFC000-memory.dmp
memory/5104-19-0x0000000004F70000-0x00000000055BA000-memory.dmp
memory/5104-21-0x0000000004F00000-0x0000000004F66000-memory.dmp
memory/5540-41-0x00000000707D0000-0x0000000070B2B000-memory.dmp
memory/5540-48-0x0000000009B40000-0x0000000009B64000-memory.dmp
memory/5540-37-0x00000000072E0000-0x0000000007302000-memory.dmp
memory/5540-38-0x0000000008550000-0x0000000008B0A000-memory.dmp
memory/5540-39-0x0000000007430000-0x0000000007466000-memory.dmp
memory/5540-40-0x0000000070650000-0x000000007069C000-memory.dmp
memory/5540-44-0x0000000007790000-0x00000000077B0000-memory.dmp
memory/5540-34-0x0000000005BA0000-0x0000000005EFB000-memory.dmp
memory/5540-45-0x0000000007840000-0x00000000078E3000-memory.dmp
memory/5540-46-0x00000000083B0000-0x00000000083BA000-memory.dmp
memory/5540-47-0x0000000009B10000-0x0000000009B3A000-memory.dmp
memory/5540-36-0x0000000007350000-0x00000000073E6000-memory.dmp
memory/5540-49-0x0000000007750000-0x0000000007758000-memory.dmp
memory/5540-50-0x0000000010000000-0x0000000010060000-memory.dmp
memory/5540-58-0x0000000010000000-0x0000000010060000-memory.dmp
memory/5540-57-0x0000000010000000-0x0000000010060000-memory.dmp
memory/5540-55-0x0000000010000000-0x0000000010060000-memory.dmp
memory/5540-56-0x0000000010000000-0x0000000010060000-memory.dmp
memory/5928-59-0x0000000010000000-0x0000000010020000-memory.dmp
memory/5928-61-0x0000000010000000-0x0000000010020000-memory.dmp
memory/5928-60-0x0000000002560000-0x00000000025A2000-memory.dmp
memory/5928-64-0x0000000005200000-0x0000000005250000-memory.dmp
memory/5928-65-0x00000000058B0000-0x0000000005942000-memory.dmp
memory/5928-66-0x0000000005810000-0x000000000581A000-memory.dmp