Analysis
-
max time kernel
108s -
max time network
48s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-07-2021 12:35
Static task
static1
Behavioral task
behavioral1
Sample
comprobante de pago.PDF.bat.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
comprobante de pago.PDF.bat.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
comprobante de pago.PDF.bat.exe
-
Size
1.1MB
-
MD5
8b606ce363521b23c5db44784d3999c4
-
SHA1
ec7ad43128b11370fc53d93573c65b6e5b048fcd
-
SHA256
a2cb7106a55573bd7292b3bda6280a141c91e0e0fdaf4253f4f8e18b7127823e
-
SHA512
fac927b712ac43c2cfe9d6c46ae189a1b41e1b0f85081f4379056de8a7c218d193da9e07a6a51ee1d451be74f894092a627b1d50e2dbc5e73ba5340a45132694
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
serv-10708.handsonwebhosting.com - Port:
587 - Username:
[email protected] - Password:
icui4cu2@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1512-65-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/1512-66-0x000000000043774E-mapping.dmp family_agenttesla behavioral1/memory/1512-67-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Drops file in Drivers directory 1 IoCs
Processes:
comprobante de pago.PDF.bat.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts comprobante de pago.PDF.bat.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
comprobante de pago.PDF.bat.exedescription pid process target process PID 332 set thread context of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
comprobante de pago.PDF.bat.exepid process 1512 comprobante de pago.PDF.bat.exe 1512 comprobante de pago.PDF.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
comprobante de pago.PDF.bat.exedescription pid process Token: SeDebugPrivilege 1512 comprobante de pago.PDF.bat.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
comprobante de pago.PDF.bat.exedescription pid process target process PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe PID 332 wrote to memory of 1512 332 comprobante de pago.PDF.bat.exe comprobante de pago.PDF.bat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\comprobante de pago.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\comprobante de pago.PDF.bat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\comprobante de pago.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\comprobante de pago.PDF.bat.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-59-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB
-
memory/332-61-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/332-62-0x0000000000440000-0x000000000045B000-memory.dmpFilesize
108KB
-
memory/332-63-0x0000000007F20000-0x0000000007FA2000-memory.dmpFilesize
520KB
-
memory/332-64-0x00000000005E0000-0x000000000061D000-memory.dmpFilesize
244KB
-
memory/1512-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1512-66-0x000000000043774E-mapping.dmp
-
memory/1512-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1512-69-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB