Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
26/03/2026, 08:11
General
- Target INVOICECOPY.js
- Size 343KB
- Sample260326-j3hlssay8k
- SHA256 c140797c9149ceb0cc39430a291caa6dfc2f92cd07d5b6b15cf6758f7093d7b3
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.corwineagles.com
-
Port
21
-
Username
-
Password
-DHG8CfN^;]q
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\INVOICECOPY.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -W h -NOp -NONI -EP BypAsS -Command "iex $env:YlvtCvPdLOcK"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -W h -NOp -NONI -EP BypAsS -Command "iex $env:YlvtCvPdLOcK"3⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ifqw1mon.oh4.ps1
memory/3688-12-0x00000137EBD30000-0x00000137EBD40000-memory.dmp
memory/3688-0-0x00000137EBD30000-0x00000137EBD40000-memory.dmp
memory/3688-9-0x00000137EBBF0000-0x00000137EBC12000-memory.dmp
memory/3688-10-0x00000137EBC70000-0x00000137EBC96000-memory.dmp
memory/3688-11-0x00000137EBC60000-0x00000137EBC6C000-memory.dmp
memory/3688-1-0x00000137EBD30000-0x00000137EBD40000-memory.dmp
memory/3688-13-0x00000137EBD30000-0x00000137EBD40000-memory.dmp
memory/3688-16-0x00000137D1A40000-0x00000137D1A4C000-memory.dmp
memory/3688-17-0x00000137D3950000-0x00000137D39F9000-memory.dmp
memory/3688-20-0x00000137EC080000-0x00000137EC0C2000-memory.dmp
memory/3688-29-0x00000137EC510000-0x00000137EC560000-memory.dmp
memory/4112-15-0x000001CF7B870000-0x000001CF7B87C000-memory.dmp
memory/4112-14-0x000001CF7B8D0000-0x000001CF7B979000-memory.dmp