Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 09:47
General
- Target 230294935.exe
- Size 785KB
- Sample261007-lsbrlswvgv
- SHA256 44c2f46e91c4b65b6f0c8385910af36a4255bba0fdd7bfccf2199e7a9faf19f7
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.vilimorin.com
-
Port
21
-
Username
-
Password
ODqJo~U!=@pQ(@;1
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\230294935.exe"C:\Users\Admin\AppData\Local\Temp\230294935.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\230294935.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_3yqy0px2.2gd.psm1
memory/3048-10-0x0000000008780000-0x0000000008800000-memory.dmp
memory/3048-2-0x0000000006310000-0x00000000068CA000-memory.dmp
memory/3048-3-0x0000000005BF0000-0x0000000005C82000-memory.dmp
memory/3048-4-0x0000000005BC0000-0x0000000005BCA000-memory.dmp
memory/3048-5-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3048-6-0x0000000005DB0000-0x0000000005DD0000-memory.dmp
memory/3048-7-0x0000000074862000-0x0000000074863000-memory.dmp
memory/3048-8-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3048-24-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3048-9-0x0000000008820000-0x00000000088BC000-memory.dmp
memory/3048-1-0x0000000000FE0000-0x00000000010AA000-memory.dmp
memory/3048-12-0x0000000009320000-0x00000000097EC000-memory.dmp
memory/3048-11-0x0000000008DF0000-0x000000000931C000-memory.dmp
memory/3048-0-0x0000000074862000-0x0000000074863000-memory.dmp
memory/4588-41-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4588-15-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/4588-18-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4588-14-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4588-37-0x0000000006B80000-0x0000000006BD0000-memory.dmp
memory/4588-13-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4800-17-0x0000000005D30000-0x000000000637A000-memory.dmp
memory/4800-21-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/4800-25-0x00000000064C0000-0x000000000681B000-memory.dmp
memory/4800-26-0x00000000069A0000-0x00000000069BE000-memory.dmp
memory/4800-27-0x0000000006D10000-0x0000000006D5C000-memory.dmp
memory/4800-28-0x0000000007990000-0x00000000079C6000-memory.dmp
memory/4800-29-0x0000000075130000-0x000000007517C000-memory.dmp
memory/4800-20-0x0000000005AD0000-0x0000000005AF2000-memory.dmp
memory/4800-32-0x0000000007970000-0x0000000007990000-memory.dmp
memory/4800-33-0x0000000007BD0000-0x0000000007C73000-memory.dmp
memory/4800-34-0x0000000008350000-0x00000000089CC000-memory.dmp
memory/4800-35-0x0000000007D10000-0x0000000007D2A000-memory.dmp
memory/4800-36-0x0000000007D80000-0x0000000007D8A000-memory.dmp
memory/4800-19-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4800-38-0x0000000008020000-0x00000000080B6000-memory.dmp
memory/4800-40-0x0000000074850000-0x000000007500C000-memory.dmp
memory/4800-16-0x0000000003190000-0x00000000031C6000-memory.dmp