Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 11:01
General
- Target fd4a337a7c2448617bff0e1c7cf7f3d2cf40683b0b33d1d079dba5f0c9a48856.exe
- Size 235KB
- Sample260910-m4tl8ssbjh
- SHA256 fd4a337a7c2448617bff0e1c7cf7f3d2cf40683b0b33d1d079dba5f0c9a48856
Malware Config
Extracted
-
Protocol
smtp
-
Host
mail.commtechtrading.com
-
Port
587
-
Username
-
Password
X{a?a?d;__@G
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.commtechtrading.com
-
Port
587
-
Username
-
Password
X{a?a?d;__@G
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd4a337a7c2448617bff0e1c7cf7f3d2cf40683b0b33d1d079dba5f0c9a48856.exe"C:\Users\Admin\AppData\Local\Temp\fd4a337a7c2448617bff0e1c7cf7f3d2cf40683b0b33d1d079dba5f0c9a48856.exe"1⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1404-0-0x00000000009A0000-0x00000000009E2000-memory.dmp
memory/1404-1-0x0000000005A10000-0x0000000005FB4000-memory.dmp
memory/1404-2-0x0000000005330000-0x0000000005340000-memory.dmp
memory/1404-3-0x00000000054D0000-0x0000000005536000-memory.dmp
memory/1404-4-0x0000000006310000-0x0000000006360000-memory.dmp
memory/1404-5-0x0000000006400000-0x000000000649C000-memory.dmp
memory/1404-6-0x00000000069C0000-0x0000000006A52000-memory.dmp
memory/1404-7-0x0000000006980000-0x000000000698A000-memory.dmp
memory/1404-8-0x0000000005330000-0x0000000005340000-memory.dmp