Analysis
- max time kernel
149s - max time network
120s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/03/2026, 08:11
General
- Target INVOICECOPY.js
- Size 343KB
- Sample260326-j3hlssay8k
- SHA256 c140797c9149ceb0cc39430a291caa6dfc2f92cd07d5b6b15cf6758f7093d7b3
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.corwineagles.com
-
Port
21
-
Username
-
Password
-DHG8CfN^;]q
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Agenttesla family
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\INVOICECOPY.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -W h -NOp -NONI -EP BypAsS -Command "iex $env:YlvtCvPdLOcK"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -W h -NOp -NONI -EP BypAsS -Command "iex $env:YlvtCvPdLOcK"3⤵
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kuoztgko.0ev.ps1
memory/1764-15-0x00000290E07A0000-0x00000290E07AC000-memory.dmp
memory/5608-13-0x000002BD2BE00000-0x000002BD2BE50000-memory.dmp
memory/5608-8-0x000002BD2BCE0000-0x000002BD2BD06000-memory.dmp
memory/5608-9-0x000002BD2BCD0000-0x000002BD2BCDC000-memory.dmp
memory/5608-12-0x000002BD2BD70000-0x000002BD2BDB2000-memory.dmp
memory/5608-0-0x000002BD2BE90000-0x000002BD2BEA0000-memory.dmp
memory/5608-14-0x000002BD2BE90000-0x000002BD2BEA0000-memory.dmp
memory/5608-6-0x000002BD13B90000-0x000002BD13BB2000-memory.dmp
memory/5608-16-0x000002BD13480000-0x000002BD1348C000-memory.dmp
memory/5608-17-0x000002BD13B70000-0x000002BD13B82000-memory.dmp
memory/5608-19-0x000002BD2BE90000-0x000002BD2BEA0000-memory.dmp
memory/5608-18-0x000002BD13BE0000-0x000002BD13C4F000-memory.dmp
memory/5608-60-0x000002BD13BE0000-0x000002BD13C4F000-memory.dmp