Sample Report — 127c404a67f2d8c1673bd85759a1875b2e87055c506d769f1b7c699dbefb50bb

Build / RE

Toolchain and Packaging

• Compiler / Linker: MSVC 14.16 (Visual Studio 2017), Microsoft linker 14.16 — standard AutoItSC v3.3.8.1 single-file PE32 output. ^[file.txt]
• Binary type: PE32 executable (GUI) Intel 80386, 5 sections (.text, .rdata, .data, .rsrc, .reloc). ^[file.txt]
• Script placement: Compiled AutoIt script stored as RT_RCDATA resource ID SCRIPT in .rsrc, AU3!EA06 header confirmed at lines 1418 and 1785. ^[strings.txt:1418] ^[strings.txt:1785]
• Packing: Plain PE32 (non-UPX). No compression or authenticode signature.
• Build timestamp: Genuine Jul 2024 PE timestamp (not the fabricated Jan 2012 seen in some siblings).
• Version info: Empty VS_VERSIONINFO block, consistent with cluster.

Anti-Analysis / Obfuscation

• String obfuscation: Custom P3059Y1DO() function in extracted AutoIt script uses a stride-3 decimal decoder — every 3rd character is noise; the first two characters of each triple are parsed as decimal (Dec()) and converted to ASCII (Chr()). This is a cluster variant of the stride-3 obfuscation pattern. ^[script.au3]
• Decoded API names (examples): kernel32.dll, CreateFileA, CreateFileW, GetFileSizeEx, ReadFile, CloseHandle, VirtualAlloc, RtlMoveMemory, ShellExecuteA, GetCommandLineA. ^[script.au3]
• Payload filenames: parachronistic and reaffection — biological/lexical nonce naming consistent with the cluster's word-list generation (e.g., ambiparous, Esher, maneuverability, sulfhydric). ^[script.au3]

Embedded Resources and Payloads

• FileInstall drops: Script drops two files to @TempDir:
  • parachronistic — 97,792-byte encrypted inner payload (entropy ~7.99).
  • reaffection — 86,022-byte ASCII hex-encoded x86 shellcode text.
• Shellcode decode: reaffection decoded by taking every 3 chars, using the first two as hex digits, producing 14,336 bytes of x86 shellcode. Entry point offset 0x23b0, executed via DllCallAddress after VirtualAlloc with PAGE_EXECUTE_READWRITE (0x40) and MEM_COMMIT|MEM_RESERVE (0x3000). ^[script.au3] ^[r2:fcn.000023b0]
• Shellcode XOR decryptor (fcn.000022e0): Simple byte-wise XOR loop data[i] ^= key[i % key_len]. The 15-byte key K1DOQHHP0ZQDOL4 is constructed on the stack via sequential mov instructions in fcn.000023b0. ^[r2:fcn.000022e0] ^[r2:fcn.000023b0]
• Decrypted inner payload: Valid PE32 executable (GUI) Intel 80386, Mono/.NET assembly, 3 sections. Single import mscoree.dll. ^[terminal:file]
• Inner payload SHA-256: 8145724ef20d6cb90e2dec5761da650b64d528576edd8ebbb2ae288a4a26d1ac. ^[terminal:sha256sum]

Shellcode Behaviour

• Entry point (fcn.000023b0): Opens %TEMP%\parachronistic via CreateFileA, reads entire file with GetFileSizeEx / ReadFile, allocates RWX buffer via VirtualAlloc, decrypts in-place with XOR key K1DOQHHP0ZQDOL4, then transfers execution to fcn.000012a0. ^[r2:fcn.000023b0]
• PE loader (fcn.000012a0): Manual PE loader implementing process hollowing. Builds target paths on the stack:
  • Primary: C:\Windows\System32\svchost.exe
  • Fallback: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe Parses PE headers (e_lfanew at 0x3c, NT headers, section table at 0x14+0x18), suggesting reflective mapping / process hollowing with IAT resolution and relocation processing. ^[r2:fcn.000012a0]
• Timing gate: fcn.000022a0 performs GetTickCount / Sleep(0x1f4) / GetTickCount delta check; aborts if elapsed < 500 ms, a basic anti-emulation / anti-sandbox gate. ^[r2:fcn.000022a0]

Inner Payload Family Identification

• The decrypted .NET assembly is AgentTesla infostealer. Evidence:
  • Class names: KeyLogger, KeyLoggerEventArgs, ClipboardProxy, FFLogins.
  • API imports: SetWindowsHookExA, GetClipboardData, OpenClipboard, CloseClipboard, CopyFromScreen, CryptUnprotectData.
  • Network classes: SmtpClient, FtpWebRequest, HttpWebRequest, MailMessage.
  • Hardcoded log filename: aaalogshsindgdaLogndta — known AgentTesla default.
  • System.Net.Mail and System.Net namespaces with credential property accessors (get_Password, get_UserName, get_hostname). ^[strings]
• This matches the cluster's established pattern: AutoItSC wrapper → hex-encoded shellcode → XOR-decrypted .NET AgentTesla payload → process hollowing into svchost.exe or .NET surrogate. Siblings 0efed3b3, 6718622d, b017d189, accd2ccd all exhibit the same chain.

Deploy / ATT&CK

Execution

• T1059.005 — Command and Scripting Interpreter: AutoIt. Compiled script runs inside the AutoIt interpreter embedded in the PE. ^[file.txt] ^[strings.txt:1418]
• T1055 — Process Injection. Shellcode manually maps and injects the decrypted .NET payload into svchost.exe (or RegSvcs.exe fallback). ^[r2:fcn.000012a0]
• T1055.012 — Process Hollowing. PE parsing logic (e_lfanew, NT headers, section table traversal) in fcn.000012a0 confirms hollowing rather than simple DLL injection. ^[r2:fcn.000012a0]

Defense Evasion

• T1027 — Obfuscated Files or Information. Stride-3 decimal string obfuscation (P3059Y1DO) hides API names and payload filenames. ^[script.au3]
• T1027.002 — Software Packing. Compiled AutoIt bytecode in .rsrc provides natural static obfuscation. ^[strings.txt:1418]
• T1497.001 — Virtualization/Sandbox Evasion: System Checks. GetTickCount delta gate in shellcode (fcn.000022a0). ^[r2:fcn.000022a0]
• T1620 — Reflective Code Loading. Shellcode is decoded, allocated RWX, and executed reflectively via DllCallAddress without touching disk as executable. ^[script.au3]

Credential Access

• T1003 — OS Credential Dumping. AgentTesla targets browser credential stores (Login Data, key4.db, logins.json), Windows Credential Manager (CryptUnprotectData), and email clients. Inferred from .NET strings. ^[strings]
• T1003.001 — LSASS Memory (indirect). AgentTesla variants frequently dump credentials from browser storage and the Windows Vault rather than LSASS directly.

Collection

• T1113 — Screen Capture. CopyFromScreen and get_Screen present in inner payload. ^[strings]
• T1115 — Clipboard Data. GetClipboardData, OpenClipboard, ClipboardProxy present. ^[strings]
• T1056.001 — Input Capture: Keylogging. SetWindowsHookExA, KeyLogger, KeyLoggerEventArgs classes. ^[strings]
• T1005 — Data from Local System. File enumeration and browser data harvesting via AgentTesla's built-in modules. Inferred.

Discovery

• T1082 — System Information Discovery. AgentTella collects OS version, machine name, and user profile data. Inferred.
• T1012 — Query Registry. Registry value access present in .NET payload. Inferred.

Exfiltration

• T1041 — Exfiltration Over C2 Channel. AgentTesla exfiltrates via SmtpClient (SMTP), FtpWebRequest (FTP), or HttpWebRequest (HTTP POST). Hardcoded credentials typically found in config strings; none recovered statically from this payload. ^[strings]
• T1071.003 — Mail Protocols. SMTP is the primary exfil channel for this family. ^[strings]

Attribution

• Cluster: unclassified-autoit-compiled — forty-ninth confirmed sibling. Same AutoItSC v3.3.8.1 toolchain, same AU3!EA06 script header, same DllCallAddress at offset 0x23b0, same hex-encoded shellcode intermediary pattern, same process-hollowing targets (svchost.exe / RegSvcs.exe), same biological/lexical nonce payload naming. ^[entities/unclassified-autoit-compiled.md]
• Inner payload family: AgentTesla — confirmed by class names, API surface, and log filename aaalogshsindgdaLogndta. ^[entities/agenttesla.md]
• Confidence: High for both cluster and inner-family attribution.

Indicators

References

• unclassified-autoit-compiled — delivery mechanism cluster page
• agenttesla — inner payload family page
• p3059y1do-stride3-decimal-obfuscation — string obfuscation technique
• process-hollowing-svchost-regsvcs — process hollowing technique
• dllcalladdress-shellcode-execution — shellcode execution technique
• agenttesla-infostealer-dotnet — inner payload concept

Analyst: Titus | Date: 2026-07-17 | Confidence: High