Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/10/2026, 18:05
General
- Target NEW PO 20416875.js
- Size 688KB
- Sample261007-wpfaqscx3s
- SHA256 6ccc3ab2d841beb56ac6854d1a0445cf87ee746600234b53f167bac3a14fadc2
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.gaiadeqi.com
-
Port
21
-
Username
-
Password
UHto%HHGCHK=,510
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\NEW PO 20416875.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:PMGRDTT))2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\98841962132810.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\98841962132810.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:YKBJCUXCQ))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:YKBJCUXCQ))"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:YKBJCUXCQ))"4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\98841962132810.cmd"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
98841962132810.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_e30vyuiq.m53.psm1
handoff_dbg_2392_e59d557.txt
handoff_dbg_2392_e59d557.txt
memory/1128-81-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1128-278-0x0000000006040000-0x00000000060D2000-memory.dmp
memory/1128-471-0x0000000000FA0000-0x0000000000FAB000-memory.dmp
memory/1128-404-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/1128-413-0x0000000005840000-0x0000000005850000-memory.dmp
memory/1128-414-0x0000000005850000-0x0000000005860000-memory.dmp
memory/1128-445-0x0000000054FC0000-0x0000000054FC1000-memory.dmp
memory/1128-447-0x0000000054FD0000-0x0000000054FD1000-memory.dmp
memory/1128-453-0x0000000055000000-0x0000000055001000-memory.dmp
memory/1128-451-0x0000000054FF0000-0x0000000054FF1000-memory.dmp
memory/1128-422-0x0000000005FA0000-0x0000000005FB0000-memory.dmp
memory/1128-424-0x0000000005FC0000-0x0000000005FD0000-memory.dmp
memory/1128-377-0x0000000005240000-0x0000000005250000-memory.dmp
memory/1128-384-0x00000000052F0000-0x0000000005300000-memory.dmp
memory/1128-378-0x0000000005250000-0x0000000005260000-memory.dmp
memory/1128-345-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1128-346-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/1128-364-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/1128-295-0x0000000000F90000-0x0000000000FA0000-memory.dmp
memory/1128-280-0x0000000006020000-0x000000000602A000-memory.dmp
memory/1128-279-0x00000000060E0000-0x0000000006130000-memory.dmp
memory/1128-73-0x0000000000D50000-0x0000000000D90000-memory.dmp
memory/1128-236-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/1128-86-0x00000000009B0000-0x00000000009B2000-memory.dmp
memory/1128-93-0x0000000000F90000-0x0000000000FA0000-memory.dmp
memory/1128-98-0x0000000001030000-0x000000000106C000-memory.dmp
memory/1128-103-0x00000000010F0000-0x000000000112C000-memory.dmp
memory/1128-104-0x0000000001130000-0x0000000001150000-memory.dmp
memory/1128-110-0x0000000002A20000-0x0000000002A60000-memory.dmp
memory/1128-125-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/1128-126-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/1128-132-0x0000000002BC0000-0x0000000002BD0000-memory.dmp
memory/1128-149-0x0000000010000000-0x0000000010040000-memory.dmp
memory/1128-155-0x0000000054540000-0x0000000054541000-memory.dmp
memory/1128-157-0x0000000054550000-0x0000000054551000-memory.dmp
memory/1128-58-0x0000000000D50000-0x0000000000D90000-memory.dmp
memory/1128-59-0x0000000000D50000-0x0000000000D90000-memory.dmp
memory/1128-62-0x0000000010000000-0x0000000010040000-memory.dmp
memory/1128-159-0x0000000054560000-0x0000000054561000-memory.dmp
memory/1128-75-0x0000000001130000-0x0000000001150000-memory.dmp
memory/1128-184-0x0000000000F90000-0x0000000000FA0000-memory.dmp
memory/1128-80-0x0000000002D50000-0x0000000002D92000-memory.dmp
memory/1128-351-0x0000000002BB0000-0x0000000002BC0000-memory.dmp
memory/1128-105-0x0000000001130000-0x0000000001150000-memory.dmp
memory/1128-165-0x0000000056960000-0x0000000056961000-memory.dmp
memory/1128-163-0x0000000056950000-0x0000000056951000-memory.dmp
memory/2392-38-0x0000000007FD0000-0x000000000864C000-memory.dmp
memory/2392-51-0x0000000007D30000-0x0000000007DD3000-memory.dmp
memory/2392-57-0x00000000087B0000-0x00000000087B8000-memory.dmp
memory/2392-56-0x00000000087C0000-0x00000000087DC000-memory.dmp
memory/2392-55-0x0000000007F90000-0x0000000007FA5000-memory.dmp
memory/2392-36-0x00000000067B0000-0x00000000067CE000-memory.dmp
memory/2392-53-0x00000000033C0000-0x00000000033D1000-memory.dmp
memory/2392-52-0x0000000007F30000-0x0000000007F3A000-memory.dmp
memory/2392-37-0x00000000067F0000-0x000000000683C000-memory.dmp
memory/2392-50-0x0000000007D10000-0x0000000007D30000-memory.dmp
memory/2392-47-0x0000000071130000-0x000000007148B000-memory.dmp
memory/2392-46-0x0000000070F80000-0x0000000070FCC000-memory.dmp
memory/2392-45-0x0000000007CB0000-0x0000000007CE6000-memory.dmp
memory/2392-42-0x0000000008C10000-0x00000000091CA000-memory.dmp
memory/2392-26-0x0000000005500000-0x0000000005536000-memory.dmp
memory/2392-41-0x00000000079E0000-0x0000000007A02000-memory.dmp
memory/2392-40-0x0000000007A40000-0x0000000007AD6000-memory.dmp
memory/2392-27-0x0000000005CC0000-0x000000000630A000-memory.dmp
memory/2392-28-0x0000000005AE0000-0x0000000005B02000-memory.dmp
memory/2392-39-0x0000000007950000-0x000000000796A000-memory.dmp
memory/2392-54-0x0000000007F80000-0x0000000007F90000-memory.dmp
memory/2392-30-0x0000000005BF0000-0x0000000005C56000-memory.dmp
memory/2392-29-0x0000000005B80000-0x0000000005BE6000-memory.dmp
memory/2392-34-0x0000000006310000-0x000000000666B000-memory.dmp
memory/4104-13-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-1-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-2-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-8-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-0-0x00007FFA36D9F000-0x00007FFA36DA0000-memory.dmp
memory/4104-9-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-6-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-5-0x00000232AD300000-0x00000232AD322000-memory.dmp
memory/4104-12-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-16-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-15-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-7-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp
memory/4104-10-0x00007FFA36C10000-0x00007FFA375B4000-memory.dmp