Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2023, 08:37

General

  • Target

    OC 1609 SOBEK Ingenieros Chile 20230829_PDF .exe

  • Size

    916KB

  • MD5

    5a0d66185fc03a6d8e34a35b8fa0f9c1

  • SHA1

    38fa755943aefe22a9115491771921b6b92e4cc2

  • SHA256

    3d935f0a6fe7d1aab765773855319fccf188e0b5704626d94574bd1b88a16b16

  • SHA512

    f59d7db127756b5de10ab282c67c0fc2d62b557395516ea88da470256f39913773315a7795ee9d13c76c17b3202c234f5e18fd2026c5d29236fbb985b06cc8c0

  • SSDEEP

    12288:oklBLFweUzGsa/XkIlidgSOS5h6ek4GFOZCjEcvdZ9AvwEbjDR9eWU:dB5Uq/0IgdNOI6f4GFOZCjLVPAva

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\OC 1609 SOBEK Ingenieros Chile 20230829_PDF .exe
    "C:\Users\Admin\AppData\Local\Temp\OC 1609 SOBEK Ingenieros Chile 20230829_PDF .exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/312-1099-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/312-1101-0x0000000004840000-0x0000000004880000-memory.dmp

    Filesize

    256KB

  • memory/312-1100-0x0000000074D40000-0x000000007542E000-memory.dmp

    Filesize

    6.9MB

  • memory/2424-39-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-45-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-5-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-7-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-9-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-11-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-13-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-15-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-17-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-19-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-21-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-23-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-25-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-27-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-29-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-31-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-33-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-43-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-37-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-0-0x00000000008C0000-0x00000000009AA000-memory.dmp

    Filesize

    936KB

  • memory/2424-4-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-41-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-35-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-47-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-49-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-51-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-53-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-55-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-57-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-59-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-61-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-63-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-65-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-67-0x0000000008600000-0x00000000086C1000-memory.dmp

    Filesize

    772KB

  • memory/2424-1030-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2424-1081-0x0000000004EC0000-0x0000000004F00000-memory.dmp

    Filesize

    256KB

  • memory/2424-1082-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/2424-1083-0x00000000022C0000-0x0000000002302000-memory.dmp

    Filesize

    264KB

  • memory/2424-1084-0x0000000004A50000-0x0000000004A9C000-memory.dmp

    Filesize

    304KB

  • memory/2424-1095-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2424-3-0x0000000008600000-0x00000000086C8000-memory.dmp

    Filesize

    800KB

  • memory/2424-2-0x0000000004EC0000-0x0000000004F00000-memory.dmp

    Filesize

    256KB

  • memory/2424-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB