43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a_extracted\43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a.exe

Dropped files (1)

• C:\Users\lab\AppData\Local\Temp\nss7919.tmp\System.dll

MITRE ATT&CK

Indicators of Compromise (defanged)

• 1666811709b9905e72f7065703bb176b149525e8
• 529a4e8314130d9693118be4e2ed9c2a
• C:\Users\lab\AppData\Local\Temp\nss7919.tmp\System.dll

IOCs (JSON)Copy

{
  "sha256": "43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a",
  "family": "AgentTesla",
  "verdict": "suspicious",
  "confidence": 90,
  "signals": [
    "executable-drop",
    "child-processes"
  ],
  "attack": [
    "T1105",
    "T1059"
  ],
  "dropped": [
    "C:\\Users\\lab\\AppData\\Local\\Temp\\nss7919.tmp\\System.dll"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a_extracted\\43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a.exe"
  ]
}