Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 14:27
General
- Target RFQ-0001468BECRISA.vbs
- Size 347KB
- Sample261107-rssysayygs
- SHA256 46aa68905416dd159ddeb1fda44dfff4f415de0010de8c74a6ed0e902d7f9894
Malware Config
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
mail.trimnt.com
-
Port
587
-
Username
-
Password
s4=O8tsknbClU8b_
-
Email to
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ-0001468BECRISA.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\cxdjvmhlkk\w12512.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio" mkdir "C:\Users\Admin\AppData\Local\Photo Studio"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c if not exist "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs" copy /y "C:\Users\Admin\AppData\Local\Temp\RFQ-0001468BECRISA.vbs" "C:\Users\Admin\AppData\Local\Photo Studio\PhotoStudio.vbs"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "PhotoStudioVBS" /xml "C:\Users\Admin\AppData\Local\Temp\mfp_x84484.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\mfp_x84484.xml"2⤵
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
w12512.ps1
mfp_x84484.xml
memory/3720-7-0x0000000005400000-0x0000000005466000-memory.dmp
memory/3720-18-0x0000000006720000-0x000000000673A000-memory.dmp
memory/3720-6-0x0000000005360000-0x0000000005382000-memory.dmp
memory/3720-2-0x0000000074442000-0x0000000074443000-memory.dmp
memory/3720-8-0x0000000005470000-0x00000000054D6000-memory.dmp
memory/3720-11-0x0000000005D70000-0x00000000060CB000-memory.dmp
memory/3720-12-0x0000000006140000-0x000000000615E000-memory.dmp
memory/3720-13-0x00000000063A0000-0x00000000063EC000-memory.dmp
memory/3720-5-0x00000000055E0000-0x0000000005C2A000-memory.dmp
memory/3720-15-0x0000000074430000-0x0000000074BEC000-memory.dmp
memory/3720-17-0x00000000079D0000-0x000000000804C000-memory.dmp
memory/3720-4-0x0000000074430000-0x0000000074BEC000-memory.dmp
memory/3720-3-0x0000000002C30000-0x0000000002C66000-memory.dmp
memory/3720-20-0x0000000002F30000-0x0000000002F4A000-memory.dmp
memory/3720-21-0x0000000007390000-0x0000000007398000-memory.dmp
memory/3720-25-0x0000000074430000-0x0000000074BEC000-memory.dmp
memory/5340-23-0x0000000005B60000-0x000000000611A000-memory.dmp
memory/5340-22-0x0000000000400000-0x0000000000448000-memory.dmp
memory/5340-26-0x0000000006990000-0x0000000006A22000-memory.dmp
memory/5340-27-0x0000000006A70000-0x0000000006AC0000-memory.dmp
memory/5340-28-0x0000000006A50000-0x0000000006A5A000-memory.dmp