Analysis
- max time kernel
150s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
compromiso de pago.scr
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
compromiso de pago.scr
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target compromiso de pago.scr
- Size 1.5MB
- Sample201109-6lt7f6ppne
- SHA256 558b8c8aefc1c9d95edc73a36381ce4a4f1a3de33208dad867d8b74d9d20aa3b
- MD5 ad31aba7d58894438239e2421642335c
- SHA1 3d72434c3818a08e20d57852443b604156a61786
- SHA512 9e923ed6383c217d7350dde95bbaf0e3fa3f1fd22ab5f3bd782c09bf4c1633bda87759ed735ef279051f423be4668d2268902fa018846f26fbe22fa344e14ef7
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
fresh826699
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- AgentTesla Payload 2 IoCs
resource yara_rule behavioral2/memory/3584-0-0x0000000000400000-0x000000000044E000-memory.dmp family_agenttesla behavioral2/memory/3584-1-0x000000000044999E-mapping.dmp family_agenttesla - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3372 set thread context of 3584 3372 compromiso de pago.scr 75 - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3584 MSBuild.exe 3584 MSBuild.exe 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3584 MSBuild.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3372 compromiso de pago.scr 3372 compromiso de pago.scr 3372 compromiso de pago.scr - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3584 MSBuild.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3372 wrote to memory of 3584 3372 compromiso de pago.scr 75 PID 3372 wrote to memory of 3584 3372 compromiso de pago.scr 75 PID 3372 wrote to memory of 3584 3372 compromiso de pago.scr 75 PID 3372 wrote to memory of 3584 3372 compromiso de pago.scr 75 PID 3372 wrote to memory of 3584 3372 compromiso de pago.scr 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\compromiso de pago.scr"C:\Users\Admin\AppData\Local\Temp\compromiso de pago.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3584
-