agenttesla | 10b20f6a5b63fd71e34ffe22ff67dec1e9a1d1b31ef700c61134a08af68075d8

General

Target
Engtek Inquiry List 770911.js
Size 529KB
Sample260818-2repwatwf1
SHA256 10b20f6a5b63fd71e34ffe22ff67dec1e9a1d1b31ef700c61134a08af68075d8
MD5 83d12db46c117393ec44b71fc3c0df8f
SHA1 6a08cfdd0f0fa42d799a1b6658d652f90bc9884b
SHA512 eaec096f22232ed4a0685dae42d4c5fee7fdecd73d522be6aa41f15fd70db95adfa977ef9731f7d39e9fb2e5f8d4cf1a6d0aa6568c9fab3ec3e8bb987e2a7321
SSDEEP 6144:huAW+qaDWS2N+QMRB1mDiupj0VqVlmfWSRu6GyiFhs:huAW1fGDb1mDiuCVqVlmfWf6cA
TLSH
T10CB4401D3D48BF886267902AD6C74375FA6EAD6BAB1F2D0F519BC1DC03A19049C43DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection execution agenttesla keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
mail.outlook-office365.com
Port
587
Username
[email protected]
Password
Payday2026
Email to
[email protected]

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	616	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
616	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
7	616	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
616	powershell.exe
616	powershell.exe
616	powershell.exe
616	powershell.exe
616	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4092	conhost.exe
616	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 4620	4092	conhost.exe	93
PID 5960 wrote to memory of 616	5960	conhost.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Engtek Inquiry List 770911.js"
1⤵
PID:4560

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:4620

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:3140

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\1clwmsz9811s\1clwmsz9811s.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\1clwmsz9811s\1clwmsz9811s.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - outlook_office_path
  PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1clwmsz9811s.ps1

Path C:\Users\Admin\AppData\Local\Temp\1clwmsz9811s\1clwmsz9811s.ps1
Size 1KB
SHA256 f84db445d3c14880382e5c01ad77661fafe74c75be6edbe19329386fe4c242ab
MD5 c1118a10c02598931a8a9aa37abefd85
SHA1 3655e952a8c8e802a5c7ce5ac2a2330fe86bc6cf
SHA512 27d8d1309285e409ce3beb2d1a47df4ea3765e653ca189192edb57eb769068a746354ce442cbec2366386167e8e6309df327babd06cce2346ce620ff1cd96d0f
TLSH
T1CE3120203D82EB7504C9A02F9D7311D9C0307C8EA28E1B89F64AC53D5206646ABD23AB
MD5 SHA1 SHA512 TLSH

Submit Download

1clwmsz9811sa

Path C:\Users\Admin\AppData\Local\Temp\1clwmsz9811s\1clwmsz9811sa
Size 65KB
SHA256 d9aa8cd857968dff03ca12d96060b4b599276292644909ed3d14fe1817bfb3ac
MD5 bc279d5c0d99a48ea6201157aaeff0c9
SHA1 6d36110f10846379476048a6c041b1390229e5c3
SHA512 1d63a730d2eb2b434f2b3c1e496d2b499847ff59ac5827816526ad3feac6d5dc0047e61a67f2f1e6af65d1ea5251c77ac310d57a2e1680cbea85b28bef616981
SSDEEP 1536:H1tIsP1ZNeUFWPdj9KV3K3/Jh9bB93BtJdttHjENY3nOu14Zf8TtdMS:j7NeYU9KlKRh9bB93B9D3jmZf4d3
TLSH
T1AA53025D74C92D88314CEB3C25F25EAE03F05B3FFC705A958284E46E8785A02CAEF199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1clwmsz9811sb

Path C:\Users\Admin\AppData\Local\Temp\1clwmsz9811s\1clwmsz9811sb
Size 65KB
SHA256 293b7d55d29d7cf4cf9af24a51d89d1534ae0f4fcf53e195e20fb1a3f043ac59
MD5 47426e9efd2a3eeb31e2ecbf54765482
SHA1 13aeba1e971aceb01781994e2c6a7bc754a83850
SHA512 40828db5916ba385525ea1be04d08131713509b3433df05676f2d2ead321661f1be5794ec7fbd89d12cacb1fc28a54ce80c7f54203e75bd4177cb07910340692
SSDEEP 1536:MxFW/4lvPtdg2VoE9j0Q+7odzhO4+u/4+k6JKfS2Vw:MxF64lvPwm24zor4Dk6Jau
TLSH
T1D853020B11E14C65607DCB0D3179233FADC19DA84CEFABC152E9DDFA2161A68816BC6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-3-0x0000021774C70000-0x0000021774C92000-memory.dmp

Download

memory/616-9-0x0000021775040000-0x0000021775090000-memory.dmp

Download

memory/616-10-0x0000021774800000-0x0000021774812000-memory.dmp

Download

memory/616-11-0x00000217758B0000-0x00000217758F0000-memory.dmp

Download

memory/616-12-0x0000021775940000-0x0000021775990000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads