Analysis
- max time kernel
2s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 08:53
General
- Target classLincoln.ps1
- Size 1.0MB
- Sample261006-ktnbcsvcpg
- SHA256 78be24965e3c95bcc64de28e51e9ddf7ad91ce920a05a483a8cdf7e1be80294d
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.dankely.org
-
Port
21
-
Username
-
Password
!?jSK$}v08$[
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\classLincoln.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4328-16-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-19-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-4-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-5-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-6-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-7-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-8-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-9-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-10-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-11-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-12-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-13-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-14-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-15-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-3-0x000001F2159A0000-0x000001F2159C2000-memory.dmp
memory/4328-29-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-0-0x00007FFE609EF000-0x00007FFE609F0000-memory.dmp
memory/4328-18-0x000001F2159E0000-0x000001F2159F8000-memory.dmp
memory/4328-25-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4328-17-0x00007FFE60860000-0x00007FFE61204000-memory.dmp
memory/4372-22-0x0000000074982000-0x0000000074983000-memory.dmp
memory/4372-20-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4372-24-0x0000000004FD0000-0x0000000005036000-memory.dmp
memory/4372-26-0x0000000074970000-0x000000007512C000-memory.dmp
memory/4372-27-0x0000000006270000-0x0000000006302000-memory.dmp
memory/4372-28-0x0000000006310000-0x0000000006360000-memory.dmp
memory/4372-23-0x0000000005610000-0x0000000005BCA000-memory.dmp
memory/4372-30-0x0000000006360000-0x000000000636A000-memory.dmp
memory/4372-31-0x0000000074982000-0x0000000074983000-memory.dmp
memory/4372-32-0x0000000074970000-0x000000007512C000-memory.dmp