Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 00:20
General
- Target wer.ps1
- Size 1011KB
- Sample261031-am2kashv7m
- SHA256 e23fca661fa8d348e3b0ff313c4edf754ab401db428758651e2c383f6dd7b4c6
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.alenntronics-pa.com
-
Port
587
-
Username
-
Password
Alenn_54321
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\wer.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2220-36-0x0000000074CA0000-0x000000007545C000-memory.dmp
memory/2220-25-0x0000000005670000-0x0000000005C2A000-memory.dmp
memory/2220-26-0x0000000005030000-0x0000000005096000-memory.dmp
memory/2220-35-0x0000000074CB2000-0x0000000074CB3000-memory.dmp
memory/2220-32-0x0000000005F70000-0x0000000005F7A000-memory.dmp
memory/2220-31-0x0000000005FF0000-0x0000000006082000-memory.dmp
memory/2220-30-0x0000000005F00000-0x0000000005F50000-memory.dmp
memory/2220-27-0x0000000074CA0000-0x000000007545C000-memory.dmp
memory/2220-24-0x0000000074CB2000-0x0000000074CB3000-memory.dmp
memory/2220-23-0x0000000000400000-0x0000000000440000-memory.dmp
memory/3656-17-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-8-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-14-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-15-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-16-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-12-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-18-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-19-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-20-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-21-0x0000021268EC0000-0x0000021268ED4000-memory.dmp
memory/3656-22-0x0000021268F10000-0x0000021268F16000-memory.dmp
memory/3656-11-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-4-0x0000021268ED0000-0x0000021268EF2000-memory.dmp
memory/3656-10-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-41-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-9-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-29-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-13-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-7-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-6-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-33-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-34-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-5-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-0-0x000002126878C000-0x000002126878D000-memory.dmp
memory/3656-37-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-38-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-39-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-40-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-3-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-42-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-43-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-44-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-45-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-46-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-47-0x0000021267FF0000-0x0000021268994000-memory.dmp
memory/3656-48-0x0000021267FF0000-0x0000021268994000-memory.dmp