Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260126-en - resource tags
- submitted
29/01/2026, 08:27
General
- Target ORDEN DE COMPRA.pdf.exe
- Size 1.1MB
- Sample260129-kcrbpabv4c
- SHA256 67a9288baf5c274fae60465c54accb0973ea5e570c4eb992de3c5babc16b8dae
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.duct-master.com
-
Port
21
-
Username
-
Password
6E3@9gG*8u&q%@=.
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA.pdf.exe"C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2136-504-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2136-505-0x0000000005670000-0x0000000005680000-memory.dmp
memory/2136-506-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/2136-507-0x0000000006A60000-0x0000000006AB0000-memory.dmp
memory/2136-508-0x0000000005670000-0x0000000005680000-memory.dmp
memory/4188-84-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-64-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-2-0x0000000005990000-0x0000000005A22000-memory.dmp
memory/4188-3-0x0000000005A30000-0x0000000005ACC000-memory.dmp
memory/4188-4-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/4188-5-0x0000000005940000-0x000000000594A000-memory.dmp
memory/4188-72-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-12-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-22-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-110-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-132-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-130-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-128-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-126-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-78-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-495-0x0000000005EF0000-0x0000000005EF1000-memory.dmp
memory/4188-497-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/4188-496-0x00000000075B0000-0x00000000075C6000-memory.dmp
memory/4188-122-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-120-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-118-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-116-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-114-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-108-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-106-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-104-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-100-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-98-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-96-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-94-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-92-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-90-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-88-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-86-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-498-0x0000000007650000-0x0000000007666000-memory.dmp
memory/4188-0-0x0000000000D80000-0x0000000000E98000-memory.dmp
memory/4188-82-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-80-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-124-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-1-0x0000000005F40000-0x00000000064E6000-memory.dmp
memory/4188-6-0x00000000073F0000-0x0000000007440000-memory.dmp
memory/4188-70-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-68-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-67-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-76-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-62-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-60-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-58-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-56-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-54-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-52-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-50-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-48-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-46-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-44-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-42-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-38-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-36-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-34-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-32-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-30-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-28-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-26-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-24-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-20-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-18-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-16-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-14-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-10-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-8-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-113-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-102-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-74-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-40-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-7-0x00000000073F0000-0x0000000007466000-memory.dmp
memory/4188-499-0x000000000A3D0000-0x000000000A3D6000-memory.dmp
memory/4188-500-0x0000000005B90000-0x0000000005BA0000-memory.dmp
memory/4188-501-0x0000000005B90000-0x0000000005BA0000-memory.dmp