Analysis
-
max time kernel
62s -
max time network
45s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 09:22
Static task
static1
Behavioral task
behavioral1
Sample
Facturas Pagadas al Vencimiento.exe
Resource
win7
General
-
Target
Facturas Pagadas al Vencimiento.exe
-
Size
725KB
-
MD5
d7162719f0d49a1e9af4ce811b0b2b3e
-
SHA1
387d361cc9e63027d3369e17ca614d554a1fd8a6
-
SHA256
40bf310460d64734161febd3338325fe0153da4121fbd1b91d372a0ef1ee88b5
-
SHA512
4fc039e1a6e30a3ec3f0bb0a67753cdd1278d9eeb73203196b7e7c0e32eb1b19bb0026ffff911b48d87edf83e05d7deb8562fd72df6d5149cc01dfdbe67894ed
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gascuenca.es - Port:
587 - Username:
[email protected] - Password:
gasW203@Z7
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
resource yara_rule behavioral1/memory/1196-1-0x00000000004AAC00-mapping.dmp family_agenttesla behavioral1/memory/1196-3-0x0000000000400000-0x00000000004AC000-memory.dmp family_agenttesla behavioral1/memory/1196-5-0x0000000000380000-0x00000000003D0000-memory.dmp family_agenttesla behavioral1/memory/1196-7-0x0000000000220000-0x000000000026A000-memory.dmp family_agenttesla -
resource yara_rule behavioral1/memory/1196-0-0x0000000000400000-0x00000000004AC000-memory.dmp upx behavioral1/memory/1196-2-0x0000000000400000-0x00000000004AC000-memory.dmp upx behavioral1/memory/1196-3-0x0000000000400000-0x00000000004AC000-memory.dmp upx -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1104 set thread context of 1196 1104 Facturas Pagadas al Vencimiento.exe 24 -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1104 Facturas Pagadas al Vencimiento.exe 836 Facturas Pagadas al Vencimiento.exe 836 Facturas Pagadas al Vencimiento.exe 836 Facturas Pagadas al Vencimiento.exe 836 Facturas Pagadas al Vencimiento.exe 836 Facturas Pagadas al Vencimiento.exe 836 Facturas Pagadas al Vencimiento.exe 836 Facturas Pagadas al Vencimiento.exe 1196 Facturas Pagadas al Vencimiento.exe 1196 Facturas Pagadas al Vencimiento.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1104 Facturas Pagadas al Vencimiento.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1196 Facturas Pagadas al Vencimiento.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1196 Facturas Pagadas al Vencimiento.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1196 1104 Facturas Pagadas al Vencimiento.exe 24 PID 1104 wrote to memory of 1196 1104 Facturas Pagadas al Vencimiento.exe 24 PID 1104 wrote to memory of 1196 1104 Facturas Pagadas al Vencimiento.exe 24 PID 1104 wrote to memory of 1196 1104 Facturas Pagadas al Vencimiento.exe 24 PID 1104 wrote to memory of 836 1104 Facturas Pagadas al Vencimiento.exe 25 PID 1104 wrote to memory of 836 1104 Facturas Pagadas al Vencimiento.exe 25 PID 1104 wrote to memory of 836 1104 Facturas Pagadas al Vencimiento.exe 25 PID 1104 wrote to memory of 836 1104 Facturas Pagadas al Vencimiento.exe 25 PID 1196 wrote to memory of 1092 1196 Facturas Pagadas al Vencimiento.exe 27 PID 1196 wrote to memory of 1092 1196 Facturas Pagadas al Vencimiento.exe 27 PID 1196 wrote to memory of 1092 1196 Facturas Pagadas al Vencimiento.exe 27 PID 1196 wrote to memory of 1092 1196 Facturas Pagadas al Vencimiento.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe"C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe"C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile3⤵PID:1092
-
-
-
C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe"C:\Users\Admin\AppData\Local\Temp\Facturas Pagadas al Vencimiento.exe" 2 1196 637732⤵
- Suspicious behavior: EnumeratesProcesses
PID:836
-