agenttesla | b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe
Size 1.2MB
Sample260810-sl8w4aha49
SHA256 b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3
MD5 01e298bdc100ec212290064b750fe980
SHA1 8f79e44b8a3b079c07e3da4ff5690c4618fa6898
SHA512 81a834ed70b40d49b2e473992e735b86165b1d00e2746b4563314cb6c1706be3b065c3a7385a8280cc83a366a9cb626c47c98a9e8a3c6e18a05fec9994992ffe
SSDEEP 24576:1LSp50cju7z4J3/+R3UwT0BxxCaztLf6rMjObS9ffr24uGKQrLYf7t:12prS7z6/5SgxvRxj24vKo45
TLSH
T1F845F1E4A162C8C1D8D246BBBF50E73071A71CFFB9D0C2419ED96BA375376426328627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.piovau.com
Port
21
Username
[email protected]
Password
Payment@123456

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3400	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1792	poZlflsgpW.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\poZlflsgpW = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\a4331jnmufe.ps1\""	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4224 set thread context of 2372	4224	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe	89
PID 1792 set thread context of 2900	1792	poZlflsgpW.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	poZlflsgpW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2372	RegSvcs.exe
2372	RegSvcs.exe
3400	powershell.exe
3400	powershell.exe
2900	RegSvcs.exe
2900	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	RegSvcs.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeDebugPrivilege	2900	RegSvcs.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 2372	4224	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe	89
PID 4224 wrote to memory of 2372	4224	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe	89
PID 4224 wrote to memory of 2372	4224	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe	89
PID 4224 wrote to memory of 2372	4224	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe	89
PID 4224 wrote to memory of 2372	4224	b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe	89
PID 3400 wrote to memory of 1792	3400	powershell.exe	93
PID 1792 wrote to memory of 2900	1792	poZlflsgpW.exe	95
PID 1792 wrote to memory of 2900	1792	poZlflsgpW.exe	95
PID 1792 wrote to memory of 2900	1792	poZlflsgpW.exe	95
PID 1792 wrote to memory of 2900	1792	poZlflsgpW.exe	95
PID 1792 wrote to memory of 2900	1792	poZlflsgpW.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe
"C:\Users\Admin\AppData\Local\Temp\b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\a4331jnmufe.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Users\Admin\AppData\Roaming\poZlflsgpW.exe
  "C:\Users\Admin\AppData\Roaming\poZlflsgpW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a4331jnmufe.ps1

Path C:\Users\Admin\AppData\Local\Temp\a4331jnmufe.ps1
Size 1KB
SHA256 1351fc41139038ef19706069b8f3ce2d65505ab0353027ee63c9d23b710db256
MD5 aaacc2b4ddb66e2eb9fc2e135a706f26
SHA1 1ac4b13cc06d2568cf230e95e59e33044e8ea852
SHA512 5d68dc4d22f4a36569dd0012564214b3f83b02430d05cd5f171a66caeebd0ec286468bc084c3c420a351d823cd2b79ce3ecd9c6abbdff367b35d6649dbc7306b
TLSH
T1A521C1478E8847C2446403E41517B1DDB26E71CB67BF015098EDB4AEB32BE26342ACE4
MD5 SHA1 SHA512 TLSH

Submit Download

poZlflsgpW.exe

Path C:\Users\Admin\AppData\Roaming\poZlflsgpW.exe
Size 1.2MB
SHA256 b295cc8e02baac018ca0b87232e908f4793b0bbb452d15e8370fa26a95f4add3
MD5 01e298bdc100ec212290064b750fe980
SHA1 8f79e44b8a3b079c07e3da4ff5690c4618fa6898
SHA512 81a834ed70b40d49b2e473992e735b86165b1d00e2746b4563314cb6c1706be3b065c3a7385a8280cc83a366a9cb626c47c98a9e8a3c6e18a05fec9994992ffe
SSDEEP 24576:1LSp50cju7z4J3/+R3UwT0BxxCaztLf6rMjObS9ffr24uGKQrLYf7t:12prS7z6/5SgxvRxj24vKo45
TLSH
T1F845F1E4A162C8C1D8D246BBBF50E73071A71CFFB9D0C2419ED96BA375376426328627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2372-12-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2372-35-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

memory/2372-34-0x0000000006AC0000-0x0000000006B10000-memory.dmp

Download

memory/2372-16-0x0000000005870000-0x00000000058D6000-memory.dmp

Download

memory/2372-15-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

memory/2372-14-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

memory/3400-27-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-23-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-33-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-30-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-29-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-28-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-26-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-24-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-17-0x00007FFD6B33F000-0x00007FFD6B340000-memory.dmp

Download

memory/3400-18-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/3400-21-0x000001DD7EFA0000-0x000001DD7EFC2000-memory.dmp

Download

memory/3400-22-0x00007FFD6B1B0000-0x00007FFD6BB54000-memory.dmp

Download

memory/4224-6-0x0000000005260000-0x000000000527C000-memory.dmp

Download

memory/4224-5-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

memory/4224-4-0x0000000004C70000-0x0000000004C7A000-memory.dmp

Download

memory/4224-9-0x0000000007120000-0x00000000071BC000-memory.dmp

Download

memory/4224-0-0x0000000075132000-0x0000000075133000-memory.dmp

Download

memory/4224-7-0x0000000075132000-0x0000000075133000-memory.dmp

Download

memory/4224-13-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

memory/4224-8-0x0000000075120000-0x00000000758DC000-memory.dmp

Download

memory/4224-3-0x0000000004CC0000-0x0000000004D52000-memory.dmp

Download

memory/4224-10-0x00000000071C0000-0x00000000072A2000-memory.dmp

Download

memory/4224-2-0x0000000005280000-0x000000000583A000-memory.dmp

Download

memory/4224-1-0x0000000000010000-0x000000000014A000-memory.dmp

Download