Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 09:40
General
- Target purchase order.js
- Size 691KB
- Sample260930-lm7bbstybw
- SHA256 c4dd621b13407af995b5989f7287f8500339fc83e50ddc26f6f669596213a5f5
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.ritubohara.com
-
Port
21
-
Username
-
Password
c6Z4p8Gz8d
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\purchase order.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command &($executioncontext.InvokeCommand.NewScriptBlock([string]$env:DYZXCCO))2⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\124213853169558.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\124213853169558.cmd"2⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:NCRUAVAR));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CBHSXNCIVX))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:NCRUAVAR));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CBHSXNCIVX))"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:NCRUAVAR));&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:CBHSXNCIVX))"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exe"C:\Windows\system32\choice.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\124213853169558.cmd"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
124213853169558.cmd
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_isnxutu4.12v.ps1
handoff_dbg_1432_e59af12.txt
handoff_dbg_1432_e59af12.txt
memory/1432-24-0x00000000037B0000-0x00000000037E6000-memory.dmp
memory/1432-28-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/1432-48-0x0000000008220000-0x000000000822A000-memory.dmp
memory/1432-47-0x0000000008130000-0x00000000081D3000-memory.dmp
memory/1432-46-0x0000000008090000-0x00000000080B0000-memory.dmp
memory/1432-50-0x0000000008A40000-0x0000000008A50000-memory.dmp
memory/1432-51-0x0000000008A50000-0x0000000008A65000-memory.dmp
memory/1432-52-0x0000000008AB0000-0x0000000008ACC000-memory.dmp
memory/1432-43-0x0000000071110000-0x000000007146B000-memory.dmp
memory/1432-25-0x0000000006050000-0x000000000669A000-memory.dmp
memory/1432-26-0x0000000005CF0000-0x0000000005D12000-memory.dmp
memory/1432-49-0x00000000036C0000-0x00000000036D1000-memory.dmp
memory/1432-27-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/1432-31-0x00000000066A0000-0x00000000069FB000-memory.dmp
memory/1432-53-0x0000000008AA0000-0x0000000008AA8000-memory.dmp
memory/1432-33-0x0000000006AA0000-0x0000000006ABE000-memory.dmp
memory/1432-34-0x0000000006AF0000-0x0000000006B3C000-memory.dmp
memory/1432-36-0x0000000007D40000-0x0000000007D5A000-memory.dmp
memory/1432-35-0x00000000083C0000-0x0000000008A3C000-memory.dmp
memory/1432-37-0x0000000007E30000-0x0000000007EC6000-memory.dmp
memory/1432-38-0x0000000007DD0000-0x0000000007DF2000-memory.dmp
memory/1432-39-0x0000000009000000-0x00000000095BA000-memory.dmp
memory/1432-41-0x00000000080D0000-0x0000000008106000-memory.dmp
memory/1432-42-0x0000000070FB0000-0x0000000070FFC000-memory.dmp
memory/3996-58-0x0000000010000000-0x0000000010040000-memory.dmp
memory/3996-123-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/3996-469-0x00000000001B0000-0x00000000001BB000-memory.dmp
memory/3996-365-0x0000000003360000-0x0000000003370000-memory.dmp
memory/3996-366-0x0000000003370000-0x0000000003380000-memory.dmp
memory/3996-307-0x0000000001770000-0x0000000001780000-memory.dmp
memory/3996-383-0x0000000005860000-0x0000000005870000-memory.dmp
memory/3996-410-0x0000000005D70000-0x0000000005D80000-memory.dmp
memory/3996-345-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/3996-54-0x00000000012C0000-0x0000000001300000-memory.dmp
memory/3996-55-0x00000000012C0000-0x0000000001300000-memory.dmp
memory/3996-346-0x00000000030D0000-0x00000000030D1000-memory.dmp
memory/3996-69-0x00000000012C0000-0x0000000001300000-memory.dmp
memory/3996-354-0x00000000031A0000-0x00000000031B0000-memory.dmp
memory/3996-71-0x00000000014D0000-0x00000000014F0000-memory.dmp
memory/3996-74-0x0000000003220000-0x0000000003262000-memory.dmp
memory/3996-364-0x0000000003350000-0x0000000003360000-memory.dmp
memory/3996-77-0x0000000000400000-0x0000000000450000-memory.dmp
memory/3996-82-0x0000000000F30000-0x0000000000F32000-memory.dmp
memory/3996-133-0x00000000031B0000-0x00000000031C0000-memory.dmp
memory/3996-199-0x0000000001770000-0x0000000001780000-memory.dmp
memory/3996-239-0x00000000031B0000-0x00000000031C0000-memory.dmp
memory/3996-162-0x00000000569A0000-0x00000000569A1000-memory.dmp
memory/3996-160-0x0000000056990000-0x0000000056991000-memory.dmp
memory/3996-156-0x0000000054590000-0x0000000054591000-memory.dmp
memory/3996-154-0x0000000054580000-0x0000000054581000-memory.dmp
memory/3996-152-0x0000000054570000-0x0000000054571000-memory.dmp
memory/3996-146-0x0000000010000000-0x0000000010040000-memory.dmp
memory/3996-124-0x00000000030D0000-0x00000000030D1000-memory.dmp
memory/3996-403-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/3996-106-0x00000000017A0000-0x00000000017DC000-memory.dmp
memory/3996-104-0x0000000001770000-0x0000000001780000-memory.dmp
memory/3996-94-0x00000000014D0000-0x00000000014F0000-memory.dmp
memory/3996-93-0x00000000014D0000-0x00000000014F0000-memory.dmp
memory/3996-86-0x0000000001300000-0x000000000133C000-memory.dmp
memory/3996-108-0x0000000002FA0000-0x0000000002FE0000-memory.dmp
memory/3996-276-0x00000000065A0000-0x0000000006632000-memory.dmp
memory/3996-277-0x0000000006640000-0x0000000006690000-memory.dmp
memory/3996-278-0x0000000006590000-0x000000000659A000-memory.dmp
memory/3996-450-0x0000000055020000-0x0000000055021000-memory.dmp
memory/3996-446-0x0000000055000000-0x0000000055001000-memory.dmp
memory/3996-452-0x0000000055030000-0x0000000055031000-memory.dmp
memory/3996-444-0x0000000054FF0000-0x0000000054FF1000-memory.dmp
memory/3996-423-0x0000000006530000-0x0000000006540000-memory.dmp
memory/3996-421-0x0000000006510000-0x0000000006520000-memory.dmp
memory/3996-420-0x0000000006500000-0x0000000006510000-memory.dmp
memory/4188-13-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-1-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-2-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-0-0x00007FF8DFC0F000-0x00007FF8DFC10000-memory.dmp
memory/4188-3-0x00000197334F0000-0x0000019733512000-memory.dmp
memory/4188-6-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-7-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-8-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-9-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-11-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp
memory/4188-14-0x00007FF8DFA80000-0x00007FF8E0424000-memory.dmp