e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd_extracted\e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd.exe

Dropped files (1)

• C:\Users\lab\AppData\Local\Temp\nsl6ABA.tmp\System.dll

MITRE ATT&CK

Indicators of Compromise (defanged)

• b6e624c197a3eef97ca0105b3eb9e7c3b8138702
• c9d073ae0783c17d1c211a9fa1658ed8
• C:\Users\lab\AppData\Local\Temp\nsl6ABA.tmp\System.dll

IOCs (JSON)Copy

{
  "sha256": "e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd",
  "family": "AgentTesla",
  "verdict": "suspicious",
  "confidence": 90,
  "signals": [
    "executable-drop",
    "child-processes"
  ],
  "attack": [
    "T1105",
    "T1059"
  ],
  "dropped": [
    "C:\\Users\\lab\\AppData\\Local\\Temp\\nsl6ABA.tmp\\System.dll"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd_extracted\\e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd.exe"
  ]
}