Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 08:09
General
- Target SHIPMENT DOCUMENTS SCAN_92926tqyp.js
- Size 674KB
- Sample260930-j2mt5aae56
- SHA256 62165ab180dc2a8278bb60785308b08d997328046d6c843d761ec6d9ace3c15e
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.theearlybrain.com
-
Port
587
-
Username
-
Password
Hope0515!
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SHIPMENT DOCUMENTS SCAN_92926tqyp.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:WPAIWGU))2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\73807566987165.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\73807566987165.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZNAMPRVOMKFU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:JQQOFUINBW))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZNAMPRVOMKFU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:JQQOFUINBW))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:ZNAMPRVOMKFU));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:JQQOFUINBW))"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\73807566987165.cmd"3⤵
- Views/modifies file attributes
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
73807566987165.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_fvtvhbrh.w0v.ps1
handoff_dbg_3836_e58ea6b.txt
handoff_dbg_3836_e58ea6b.txt
memory/3688-0-0x0000023559880000-0x0000023559890000-memory.dmp
memory/3688-1-0x0000023559880000-0x0000023559890000-memory.dmp
memory/3688-7-0x000002355A1E0000-0x000002355A202000-memory.dmp
memory/3836-49-0x0000000007870000-0x0000000007EEA000-memory.dmp
memory/3836-55-0x0000000007380000-0x00000000073B2000-memory.dmp
memory/3836-37-0x0000000005840000-0x00000000058A6000-memory.dmp
memory/3836-45-0x00000000058B0000-0x0000000005C04000-memory.dmp
memory/3836-47-0x0000000005EC0000-0x0000000005EDE000-memory.dmp
memory/3836-48-0x0000000005EF0000-0x0000000005F3C000-memory.dmp
memory/3836-35-0x0000000004FE0000-0x0000000005002000-memory.dmp
memory/3836-50-0x0000000007020000-0x000000000703A000-memory.dmp
memory/3836-51-0x0000000007100000-0x0000000007196000-memory.dmp
memory/3836-52-0x00000000070B0000-0x00000000070D2000-memory.dmp
memory/3836-53-0x0000000007EF0000-0x0000000008494000-memory.dmp
memory/3836-36-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/3836-56-0x0000000070990000-0x00000000709DC000-memory.dmp
memory/3836-57-0x0000000070B00000-0x0000000070E54000-memory.dmp
memory/3836-65-0x00000000073C0000-0x00000000073DE000-memory.dmp
memory/3836-66-0x0000000007460000-0x0000000007503000-memory.dmp
memory/3836-67-0x0000000007440000-0x000000000744A000-memory.dmp
memory/3836-68-0x0000000007670000-0x0000000007681000-memory.dmp
memory/3836-69-0x00000000076A0000-0x00000000076AE000-memory.dmp
memory/3836-70-0x00000000076B0000-0x00000000076C4000-memory.dmp
memory/3836-71-0x00000000076F0000-0x000000000770A000-memory.dmp
memory/3836-72-0x00000000076E0000-0x00000000076E8000-memory.dmp
memory/3836-34-0x00000000050F0000-0x0000000005718000-memory.dmp
memory/3836-33-0x00000000049D0000-0x0000000004A06000-memory.dmp
memory/4700-258-0x0000000002E10000-0x0000000002E20000-memory.dmp
memory/4700-93-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4700-88-0x0000000000D20000-0x0000000000D60000-memory.dmp
memory/4700-77-0x0000000010000000-0x0000000010040000-memory.dmp
memory/4700-92-0x00000000051B0000-0x00000000051F0000-memory.dmp
memory/4700-73-0x0000000000D20000-0x0000000000D60000-memory.dmp
memory/4700-74-0x0000000000D20000-0x0000000000D60000-memory.dmp
memory/4700-199-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/4700-176-0x0000000056790000-0x0000000056791000-memory.dmp
memory/4700-174-0x0000000056780000-0x0000000056781000-memory.dmp
memory/4700-170-0x0000000054470000-0x0000000054471000-memory.dmp
memory/4700-168-0x0000000054460000-0x0000000054461000-memory.dmp
memory/4700-166-0x0000000054450000-0x0000000054451000-memory.dmp
memory/4700-160-0x0000000010000000-0x0000000010040000-memory.dmp
memory/4700-150-0x0000000002E10000-0x0000000002E20000-memory.dmp
memory/4700-139-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/4700-137-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/4700-120-0x0000000002AC0000-0x0000000002AFB000-memory.dmp
memory/4700-106-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/4700-105-0x0000000000DA0000-0x0000000000DDB000-memory.dmp
memory/4700-103-0x0000000000D70000-0x0000000000D90000-memory.dmp
memory/4700-102-0x0000000000D70000-0x0000000000D90000-memory.dmp
memory/4700-99-0x0000000000C00000-0x0000000000C02000-memory.dmp
memory/4700-90-0x0000000000D70000-0x0000000000D90000-memory.dmp
memory/4700-294-0x0000000005F40000-0x0000000005F4A000-memory.dmp
memory/4700-293-0x0000000005E90000-0x0000000005F22000-memory.dmp
memory/4700-292-0x0000000005780000-0x00000000057D0000-memory.dmp
memory/4700-308-0x0000000000DE0000-0x0000000000DF0000-memory.dmp
memory/4700-376-0x0000000002E00000-0x0000000002E10000-memory.dmp
memory/4700-459-0x0000000054F70000-0x0000000054F71000-memory.dmp
memory/4700-457-0x0000000054F60000-0x0000000054F61000-memory.dmp
memory/4700-453-0x0000000054F40000-0x0000000054F41000-memory.dmp
memory/4700-451-0x0000000054F30000-0x0000000054F31000-memory.dmp
memory/4700-434-0x0000000005770000-0x0000000005771000-memory.dmp
memory/4700-430-0x0000000005730000-0x0000000005740000-memory.dmp
memory/4700-428-0x0000000005720000-0x0000000005730000-memory.dmp
memory/4700-427-0x0000000005710000-0x0000000005720000-memory.dmp
memory/4700-426-0x0000000005700000-0x0000000005710000-memory.dmp
memory/4700-424-0x00000000056C0000-0x00000000056D0000-memory.dmp
memory/4700-422-0x00000000056B0000-0x00000000056C0000-memory.dmp
memory/4700-403-0x00000000053F0000-0x0000000005400000-memory.dmp
memory/4700-400-0x0000000005370000-0x0000000005380000-memory.dmp
memory/4700-390-0x0000000005250000-0x0000000005260000-memory.dmp
memory/4700-389-0x0000000005240000-0x0000000005250000-memory.dmp
memory/4700-365-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/4700-363-0x0000000002C60000-0x0000000002C61000-memory.dmp
memory/4700-479-0x0000000000D90000-0x0000000000D9A000-memory.dmp